image-scanner-with-trivy/assets/lambda/dist/index.js

Scan container images with Trivy in CDK deployment

"use strict";var g=Object.defineProperty;var f=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var C=Object.prototype.hasOwnProperty;var h=(e,t)=>{for(var n in t)g(e,n,{get:t[n],enumerable:!0})},O=(e,t,n,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of S(t))!C.call(e,o)&&o!==n&&g(e,o,{get:()=>t[o],enumerable:!(i=f(t,o))||i.enumerable});return e};var L=e=>O(g({},"__esModule",{value:!0}),e);var E={};h(E,{handler:()=>w});module.exports=L(E);var l=require("child_process"),m=require("fs"),s=require("@aws-sdk/client-cloudwatch-logs");var d="/tmp/.trivyignore",c=new s.CloudWatchLogsClient,w=async function(e){let t=e.RequestType,n=e.ResourceProperties;if(!n.addr||!n.imageUri)throw new Error("addr and imageUri are required.");let i={PhysicalResourceId:n.addr,Data:{}};if(t==="Create"||t==="Update"){let o=x(n);n.trivyIgnore.length&&(console.log("trivyignore: "+JSON.stringify(n.trivyIgnore)),R(n.trivyIgnore));let a=`/opt/trivy image --no-progress ${o.join(" ")} ${n.imageUri}`;console.log("command: "+a),console.log("imageUri: "+n.imageUri);let r=(0,l.spawnSync)(a,{shell:!0});if(await $(r,n.imageUri,n.output),r.status!==0)throw new Error(`Error: ${r.error}
Signal: ${r.signal}
Status: ${r.status}
Image Scanner returned fatal errors. You may have vulnerabilities. See logs.`)}return i},x=e=>{let t=[];return e.ignoreUnfixed==="true"&&t.push("--ignore-unfixed"),e.severity.length&&t.push(`--severity ${e.severity.join(",")}`),e.scanners.length&&t.push(`--scanners ${e.scanners.join(",")}`),e.imageConfigScanners.length&&t.push(`--image-config-scanners ${e.imageConfigScanners.join(",")}`),e.exitCode&&t.push(`--exit-code ${e.exitCode}`),e.exitOnEol&&t.push(`--exit-on-eol ${e.exitOnEol}`),e.trivyIgnore.length&&t.push(`--ignorefile ${d}`),e.platform&&t.push(`--platform ${e.platform}`),t},R=e=>{let t=e.join(`
`);(0,m.writeFileSync)(d,t,"utf-8")},$=async(e,t,n)=>{switch(n?.type){case"cloudWatchLogs":await v(e,n,t);break;default:console.log(`stderr:
`+e.stderr.toString()),console.log(`stdout:
`+e.stdout.toString())}},v=async(e,t,n)=>{let[i,o]=n.split(":"),a=o?`uri=${i},tag=${o}`:`uri=${i}`;try{await c.send(new s.CreateLogStreamCommand({logGroupName:t.logGroupName,logStreamName:a}))}catch(u){if(u instanceof s.ResourceAlreadyExistsException)console.log(`Log stream ${a} already exists in log group ${t.logGroupName}.`);else throw u}let r=new Date().getTime(),p={logGroupName:t.logGroupName,logStreamName:a,logEvents:[{timestamp:r,message:`stderr:
`+e.stderr.toString()},{timestamp:r,message:`stdout:
`+e.stdout.toString()}]},y=new s.PutLogEventsCommand(p);await c.send(y),console.log(`Scan logs output to the log group: ${t.logGroupName}, log stream: ${a}`)};0&&(module.exports={handler});