KICS-keeping infrastructure as code secure

keeping infrastructure as code secure is an open source solution for static code analysis of Infrastructure as Code.

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Both the scanning engine and the security queries are clear and open for the software development community.

KICS INSTALLATION:

Execute the below command

curl -LO https://github.com/Checkmarx/kics/releases/download/v1.2.3/kics_1.2.3_linux_x64.tar.gz

it will create a tar file.

untar the file into kics folder

1. mkdir kics
2. tar xvfz kics_1.2.3_linux_x64.tar.gz -C ./kics/

file will be exacted into kics folder

Foder structure of KICS:

Kics CMD:

./kics — help

Kick a scan!

./kics scan -p ‘<path-of-your-project-to-scan>’ — report-formats json -o ./results

Result Format :

Get Dhilipsingh G’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Below supported formatted of KICS output

1. CSV
2. PDF
3. Code Climate
4. ASFF
5. CycloneDX
6. HTML
7. Sonar Qube
8. Junit
9. Gitlab SAST
10. SARIF
11. JSON

— report-formats “glsast,html,pdf” its used to define the output format

./kics scan -p <path-of-your-project-to-scan> -o ./output — report-formats “glsast,html,pdf” — output-name kics-result

Status Code:

Error code :

Scan With jenkins pipeline :

Add the stage with Docker image
stage(‘KICS scan’) { steps
{ script
{
docker.image(‘checkmarx/kics:latest’).inside(“ — entrypoint=’’”) { unstash ‘source’ sh(‘/app/bin/kics scan -p \’\$(pwd)\’ — ci — report-formats html -o \’\$(pwd)\’ — ignore-on-exit results’) archiveArtifacts(artifacts: ‘results.html’, fingerprint: true) publishHTML([allowMissing: true, alwaysLinkToLastBuild: true, keepAll: true, reportDir: ‘.’, reportFiles: ‘results.html’, reportName: ‘KICS Results’, reportTitles: ‘’])
}
}
}
if kics extracted in folder add below step
stage (‘KICS scan’){
 steps { 
 echo ‘scan cloud infrastructure in progress.’

 {
 sh “/ec2-user/kics/kics scan -p ${WORKSPACE}/ -q /ec2-user/kics/ -o results.json”
 }
 }
 }
/ec2-user/kics/ -> location where we exacted kics source
${WORKSPACE} → Terraform file will be available
-q /ec2-user/kics/ → queries-path string path to directory with querie