CloudFormation¶
AWS CloudFormation enables you to safely and predictably create, change, and improve infrastructure.
The easy_infra
project includes and secures CloudFormation as a component due to its popularity and versitility in provisioning and updating
environments as Infrastructure as Code (IaC).
easy_infra
uses security tools, such as Checkov, to transparently assess the provided IaC against the defined security policy.
Use Cases¶
If you use Software Version Control (such as git
) to manage your CloudFormation IaC, consider executing aws cloudformation validate-template
with
easy_infra as a pipeline action on commit or pull request:
docker run -v .:/iac seiso/easy_infra:latest-cloudformation aws cloudformation validate-template --template-body file://./example.yml
You can also use easy_infra to deploy your infrastructure using aws cloudformation deploy
:
docker run -v .:/iac seiso/easy_infra:latest-cloudformation aws cloudformation deploy --template-file file://./example.yml --stack-name example
Note
In order to run aws cloudformation validate-template
, AWS requires that you have an active session with AWS
Customizing Checkov¶
Many of the checkov
command line parameters can be customized or configured at runtime by setting the below environment variables. By setting these
environment variables starting with CHECKOV_
, easy_infra
will dynamically add the related arguments to the checkov
security scanning command, and
pass the value of the environment variable to the argument.
For more details regarding how these parameters work, see the checkov documentation.
Environment Variable |
CLI Argument |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
For instance:
CHECKOV_BASELINE=/iac/.checkov.baseline
CHECKOV_EXTERNAL_CHECKS_DIR=/iac/checkov_rules/
CHECKOV_SKIP_CHECK=CKV_AWS_46
docker run --env-file <(env | grep ^CHECKOV_) -v .:/iac easy_infra:latest-cloudformation aws cloudformation validate-template --template-body file://./example.yml
In addition, you can customize some checkov
-specific environment variables at runtime for different effects. By setting these environment variables, you are
customizing the checkov
environment only while it is running.
Environment Variable |
Checkov Environment |
---|---|
|
|
For instance, the following command will run with checkov
in debug mode (which is separate from running easy_infra
in debug mode):
CHECKOV_LOG_LEVEL=DEBUG
docker run --env CHECKOV_LOG_LEVEL -v .:/iac easy_infra:latest-cloudformation aws cloudformation validate-template --template-body file:///./example.yml
Disabling Security¶
The injected security tooling can be disabled entirely or individually, using easy_infra
-specific command line arguments or environment variables.
Environment variable |
Default |
Result |
---|---|---|
|
|
Disables all security tooling (Not just CloudFormation-related) when set to |
|
|
Disables Checkov when set to |
Parameter |
Result |
Example |
---|---|---|
|
Disable all security tooling |
|
|
Disable Checkov |
|
Note
All command-line arguments in the above table are processed by easy_infra and removed prior to passing parameters to aws cloudformation commands.