image-scanner-with-trivy/lib/image-scanner-with-trivy-v2.d.ts

Scan container images with Trivy in CDK deployment

import { IRepository } from 'aws-cdk-lib/aws-ecr';
import { ILogGroup } from 'aws-cdk-lib/aws-logs';
import { ITopic } from 'aws-cdk-lib/aws-sns';
import { Construct, IConstruct } from 'constructs';
import { ScanLogsOutput } from './scan-logs-output';
import { Severity, Scanners, ImageConfigScanners } from './types';
/**
 * File type for TrivyIgnore file path
 */
export declare enum TrivyIgnoreFileType {
    /**
     * .trivyignore file
     *
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignore
     */
    TRIVYIGNORE = "TRIVYIGNORE",
    /**
     * .trivyignore.yaml file
     *
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml
     */
    TRIVYIGNORE_YAML = "TRIVYIGNORE_YAML"
}
/**
 * Union-like class for specifying Trivy ignore configuration.
 *
 * You can either specify ignore rules inline, or point to an existing ignore file.
 */
export declare class TrivyIgnore {
    readonly rules: string[];
    readonly fileType?: TrivyIgnoreFileType | undefined;
    /**
     * Specify ignore rules inline (equivalent to writing lines in a .trivyignore file).
     *
     * @param rules Each element corresponds to one line in the .trivyignore file.
     *
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignore
     */
    static fromRules(rules: string[]): TrivyIgnore;
    /**
     * Specify the path to an existing trivyignore file.
     *
     * @param path Path to the ignore file.
     * @param fileType File format. Defaults to `TrivyIgnoreFileType.TRIVYIGNORE`.
     *
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignore
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml
     */
    static fromFilePath(path: string, fileType?: TrivyIgnoreFileType): TrivyIgnore;
    private constructor();
}
/**
 * Enum for Target Image Platform
 */
export declare class TargetImagePlatform {
    readonly value: string;
    /**
     * Linux AMD64 platform
     */
    static readonly LINUX_AMD64: TargetImagePlatform;
    /**
     * Linux ARM64 platform
     */
    static readonly LINUX_ARM64: TargetImagePlatform;
    /**
     * Custom value for target image platform
     *
     * The value should be in the format OS/Architecture for the image, such as `linux/arm64`.
     */
    static custom(value: string): TargetImagePlatform;
    private constructor();
}
/**
 * Properties for ImageScannerWithTrivyV2 Construct.
 */
export interface ImageScannerWithTrivyV2Props {
    /**
     * Image URI for scan target.
     */
    readonly imageUri: string;
    /**
     * Repository including the image URI for scan target.
     *
     * Because of grantPull to CustomResourceLambda.
     */
    readonly repository: IRepository;
    /**
     * The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
     *
     * To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.
     *
     * @default false
     *
     * @see https://trivy.dev/docs/latest/scanner/vulnerability/#unfixed-vulnerabilities
     */
    readonly ignoreUnfixed?: boolean;
    /**
     * Severity Selection
     *
     * The severity is taken from the selected data source since the severity from vendors is more accurate.
     * Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as "Low". As a result, Trivy will display it as "Low".
     *
     * The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software.
     * Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD.
     *
     * It defaults to `CRITICAL` IN THIS CONSTRUCT for safety in CI/CD, but the default configuration of Trivy is "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN".
     *
     * @default [Severity.CRITICAL]
     *
     * @see https://trivy.dev/docs/latest/scanner/vulnerability/#severity-selection
     */
    readonly severity?: Severity[];
    /**
     * Enable/Disable Scanners
     *
     * You can enable/disable scanners with the `scanners`.
     *
     * For example, container image scanning enables vulnerability (VULN) and secret scanners (SECRET) by default.
     * If you don't need secret scanning, it can be disabled by specifying Scanners.VULN only.
     *
     * @default [Security.VULN,Scanners.SECRET]
     *
     * @see https://trivy.dev/docs/latest/configuration/others/#enabledisable-scanners
     */
    readonly scanners?: Scanners[];
    /**
     * Enum for ImageConfigScanners
     *
     * Container images have configuration. docker inspect and `docker history` show the information according to the configuration.
     * Trivy scans the configuration of container images for
     *
     * - Misconfigurations
     * - Secrets
     *
     * They are disabled by default. You can enable them with `imageConfigScanners`.
     *
     * @default []
     *
     * @see https://trivy.dev/docs/latest/target/container_image/#container-image-metadata
     */
    readonly imageConfigScanners?: ImageConfigScanners[];
    /**
     * Whether to fail on vulnerabilities or EOL (End of Life) images
     *
     * If set to `true`, Trivy exits with a non-zero exit code when vulnerabilities or EOL images are detected.
     *
     * If set to `false`, Trivy exits with a zero exit code even when vulnerabilities or EOL images are detected.
     *
     * It defaults to `true` IN THIS CONSTRUCT for safety in CI/CD. In the original trivy, it is `false` (exit code 0).
     *
     * **Note**: When `sbomFormat` is specified in `scanLogsOutput.s3()`, SBOM generation mode is used instead of
     * vulnerability scanning. In SBOM mode, Trivy always exits with code 0 regardless of this setting, and
     * no SNS notifications will be sent even if `vulnsNotificationTopic` is configured.
     *
     * @default true
     *
     * @see https://trivy.dev/docs/latest/configuration/others/#exit-code
     */
    readonly failOnVulnerability?: boolean;
    /**
     * Ignore rules or ignore file for Trivy.
     *
     * Use `TrivyIgnore.fromRules()` to specify inline ignore rules (equivalent to writing lines
     * in a `.trivyignore` file), or `TrivyIgnore.fromFilePath()` to point to an existing ignore file.
     *
     * @default - no ignore rules
     *
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignore
     * @see https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml
     */
    readonly trivyIgnore?: TrivyIgnore;
    /**
     * Memory Size (MB) for Scanner Lambda
     *
     * You can specify between `3008` and `10240`.
     *
     * If this Construct execution terminates abnormally due to SIGKILL, try a larger size.
     *
     * Default value (`3008` MB) is Maximum Lambda memory size for default AWS account without quota limit increase.
     *
     * @default 3008
     */
    readonly memorySize?: number;
    /**
     * Scan Image on a specific Architecture and OS
     *
     * @default - Trivy loads an image on a `linux/amd64` machine.
     */
    readonly targetImagePlatform?: TargetImagePlatform;
    /**
     * The Scanner Lambda function's default log group
     *
     * If you use ImageScannerWithTrivyV2 construct multiple times in the same stack,
     * you must specify the same log group for each construct.
     *
     * See `Default Log Group` section in the README for more details.
     *
     * @default - Scanner Lambda creates the default log group(`/aws/lambda/${functionName}`).
     */
    readonly defaultLogGroup?: ILogGroup;
    /**
     * Configuration for scan logs output
     *
     * By default, scan logs are output to default log group created by Scanner Lambda.
     *
     * Specify this if you want to send scan logs to other than the default log group.
     *
     * **Note**: CloudWatch Logs has a 1 MB per log event limit. Large scan results will be
     * automatically split into multiple events with `[part X/Y]` prefixes. **For large scan
     * results, we recommend using S3 output** to avoid fragmentation and make it easier to
     * view complete results.
     *
     * @default - scan logs output to `defaultLogGroup` if specified, otherwise to the default
     * log group created by Scanner Lambda.
     */
    readonly scanLogsOutput?: ScanLogsOutput;
    /**
     * Suppress errors during rollback scanner Lambda execution
     *
     * When image scanning fails, CloudFormation triggers a rollback and executes the previous
     * version of the scanner Lambda. If this property is set to `true`, the previous version of
     * the scanner Lambda will not throw an error, even if the image scanning for the previous version
     * fails.
     *
     * This allows the rollback to complete successfully, avoiding ROLLBACK_FAILED state
     * when image scanning failures occur.
     *
     * @default true
     */
    readonly suppressErrorOnRollback?: boolean;
    /**
     * SNS topic for vulnerabilities notification
     *
     * If specified, an SNS topic notification will be sent when vulnerabilities or EOL (End of Life) OS are detected.
     *
     * The notification is sent regardless of the `failOnVulnerability` setting.
     * This means you can choose to receive notifications even when you don't want the deployment to fail.
     *
     * You can specify an SNS topic associated with AWS Chatbot, as notifications are sent in AWS Chatbot message format.
     *
     * @default - no notification
     */
    readonly vulnsNotificationTopic?: ITopic;
    /**
     * Constructs to block if vulnerabilities are detected.
     *
     * This is equivalent to calling `construct.node.addDependency(imageScanner)` for each construct.
     *
     * Note: This option only works when `failOnVulnerability` is `true` (default).
     * If `failOnVulnerability` is set to `false`, the scanner will not fail on vulnerabilities,
     * and the specified constructs will not be blocked.
     *
     * @default - no constructs to block
     */
    readonly blockConstructs?: IConstruct[];
}
/**
 * A Construct that scans container images with Trivy.
 * It uses a Lambda function as a Custom Resource provider to run Trivy and scan container images.
 */
export declare class ImageScannerWithTrivyV2 extends Construct {
    private readonly defaultLogGroup?;
    constructor(scope: Construct, id: string, props: ImageScannerWithTrivyV2Props);
    /** @internal */
    get _defaultLogGroup(): ILogGroup | undefined;
}