kics
kics copied to clipboard
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
the URL for the download file has changed since V1.5.2 and the installation script does not support it curl -sfL 'https://raw.githubusercontent.com/Checkmarx/kics/master/install.sh' | bash -s -- -b /usr/local/bin v1.5.1 ==> WORKS...
Would be nice if there was a way to configure queries based on the various compliance frameworks, such as the Cloud Security Alliance (CSA) CCM instead of just the Center...
When running Kics as docker as part of a workflow(and not using kics GitHub action), SARIF output and the "artifactLocation" are all relative to the docker volume mounting point. For...
### Expected Behavior Not throwing a **Redis Publicly Accessible** Vulnerability error when using a **for_each** on **azurerm_redis_firewall_rule** resource ### Actual Behavior Vulnerability **Redis Publicly Accessible** found on resource **azurerm_redis_firewall_rule** when...
### Expected Behavior Not finding "ECR Repository Without Policy, Severity: LOW, Results: 1". Creation of many resources is common and for_each should be used for this instead of having to...
It seems there are 2 "non root user" queries - assets/queries/dockerfile/last_user_is_root assets/queries/dockerfile/missing_user_instruction
### Platform Docker ### Query `8a301064-c291-4b20-adcb-403fe7fd95fd` ### Description The query currently checks that the `SHELL` instruction is not used at all in a Dockerfile. Instead, it suggests changing the shell...
Update "COPY '--from' Without FROM Alias Defined Previously" query for Docker, allow external images
### Platform Docker ### Query `68a51e22-ae5a-4d48-8e87-b01a323605c9` ### Description Currently, this query detects an issue when a `COPY` instruction references another docker image using `--from` and this image is not defined...
### Platform Docker ### Query `f4a6bcd3-e231-4acf-993c-aa027be50d2e` ### Description In long `RUN` commands there sometimes exists `cd`s in the middle of the Instruction to change a directory. It is not helpful...
### Expected Behavior Ignore a false positive line when preceeded by a line such as: ```yaml # kics-scan ignore-line ``` Iirc this was supposed to be fixed in PR #4662...