kics

# Checkmarx KICS (Keeping Infrastructure as Code Secure) ## When to Use KICS **Ideal scenarios:** - Infrastructure as Code (IaC) security scanning - Cloud configuration analysis (AWS, Azure, GCP, Oracle) - Kubernetes manifest security review - Dockerfile security hardening - Terraform/OpenTofu security assessment - Ansible playbook security validation - CI/CD pipeline IaC security gates - Compliance checking (CIS, PCI-DSS, NIST, SOC2) **Complements other tools:** - Use alongside application security scanners (Semgrep, CodeQL) - Combine with SARIF Issue Reporter for detailed findings - Use with cloud posture management tools ## When NOT to Use Do NOT use this skill for: - Application source code vulnerability scanning (use Semgrep or CodeQL) - Secrets detection (use Gitleaks) - Dependency vulnerability scanning (use OSV-Scanner or Depscan) - Runtime cloud posture assessment (use CSPM tools) - Binary or compiled code analysis ## Installation ```bash # Binary download (Linux) wget https://github.com/Checkmarx/kics/releases/latest/download/kics_linux_amd64.tar.gz tar -xzf kics_linux_amd64.tar.gz sudo mv kics /usr/local/bin/ # Binary download (macOS) wget https://github.com/Checkmarx/kics/releases/latest/download/kics_darwin_amd64.tar.gz tar -xzf kics_darwin_amd64.tar.gz sudo mv kics /usr/local/bin/ # Homebrew brew install kics # Docker docker pull checkmarx/kics:latest # Verify kics version ``` ## Core Workflow ### 1. Quick Scan ```bash # Scan current directory kics scan -p . # Scan specific path kics scan -p /path/to/iac # Scan with minimal output kics scan -p . --silent # No color output (for CI) kics scan -p . --no-color ``` ### 2. SARIF Output ```bash # Generate SARIF report kics scan -p /path/to/iac \ --report-formats sarif \ --output-path results.sarif # Multiple formats (JSON + SARIF) kics scan -p /path/to/iac \ --report-formats json,sarif \ --output-path . # Named output kics scan -p /path/to/iac \ --report-formats sarif \ --output-name kics-results # All formats kics scan -p /path/to/iac \ --report-formats all \ --output-path ./reports ``` ### 3. Platform-Specific Scans ```bash # AWS CloudFormation kics scan -p ./cloudformation --type CloudFormation # Terraform kics scan -p ./terraform --type Terraform # Kubernetes manifests kics scan -p ./k8s --type Kubernetes # Dockerfile kics scan -p ./docker --type Dockerfile # Ansible kics scan -p ./ansible --type Ansible # Azure Resource Manager kics scan -p ./arm --type AzureResourceManager # Google Deployment Manager kics scan -p ./gdm --type GoogleDeploymentManager # Helm charts kics scan -p ./charts --type Helm ``` ### 4. Severity Filtering ```bash # Only high and critical kics scan -p . --minimal-ui --fail-on high,critical # Exclude info findings kics scan -p . --exclude-severities info # Specific severities in SARIF kics scan -p . \ --fail-on high,critical \ --report-formats sarif \ --output-path results.sarif ``` ## Configuration ### Config File Create `.kics.yml` or `kics.config`: ```yaml # Paths to scan path: ./infrastructure # Query selection exclude-queries: - 487f4be7-3fd9-4506-a07a-96c39d0b30ad # Specific query ID # Severity settings fail-on: - high - critical # Output settings output-path: ./kics-results report-formats: - sarif - json - html # Exclude paths exclude-paths: - "./tests/**" - "./examples/**" - "**/.terraform/**" # Exclude results by similarity ID exclude-results: - abc123def456 # Platform filters type: - Terraform - Kubernetes - Dockerfile # CI mode ci: true no-color: true minimal-ui: true ``` Use config: ```bash kics scan --config .kics.yml ``` ### Inline Suppressions ```hcl # Terraform - suppress specific finding resource "aws_s3_bucket" "example" { # kics-scan ignore-line bucket = "my-bucket" acl = "public-read" # Suppressed above } # Suppress entire block # kics-scan ignore-block resource "aws_security_group" "example" { ingress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } ``` ```yaml # Kubernetes - suppress finding apiVersion: v1 kind: Pod metadata: name: example spec: # kics-scan ignore-line hostNetwork: true # Suppressed containers: - name: app image: nginx:latest # kics-scan ignore-line ``` ## CI/CD Integration (GitHub Actions) ```yaml name: KICS IaC Scan on: push: branches: [main] paths: - '**.tf' - '**.yaml' - '**.yml' - 'Dockerfile*' pull_request: paths: - '**.tf' - '**.yaml' - '**.yml' - 'Dockerfile*' jobs: kics: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run KICS uses: checkmarx/kics-github-action@v2.1.1 with: path: . output_path: kics-results output_formats: 'sarif,json,html' fail_on: high,critical enable_comments: true # PR comments exclude_paths: 'tests/**,examples/**' - name: Upload SARIF if: always() uses: github/codeql-action/upload-sarif@v3 with: sarif_file: kics-results/results.sarif category: kics - name: Upload Results if: always() uses: actions/upload-artifact@v4 with: name: kics-results path: kics-results/ ``` ## Common Use Cases ### 1. Terraform Security Audit ```bash # Comprehensive Terraform scan kics scan -p ./terraform \ --type Terraform \ --report-formats sarif,html \ --output-path ./security-audit \ --fail-on high,critical # Review HTML report open ./security-audit/results.html # Process SARIF with other tools sarif summary ./security-audit/results.sarif ``` ### 2. Kubernetes Hardening ```bash # Scan all K8s manifests kics scan -p ./k8s \ --type Kubernetes \ --report-formats sarif \ --output-name k8s-security # Focus on critical issues kics scan -p ./k8s \ --type Kubernetes \ --fail-on high,critical \ --exclude-severities low,medium,info ``` ### 3. Multi-Cloud Infrastructure ```bash # Scan mixed IaC kics scan -p ./infrastructure \ --type Terraform,CloudFormation,AzureResourceManager \ --report-formats sarif,json \ --output-path ./reports ``` ### 4. Dockerfile Security ```bash # Scan all Dockerfiles kics scan -p . \ --type Dockerfile \ --report-formats sarif \ --output-name dockerfile-scan # Include docker-compose kics scan -p . \ --type Dockerfile,DockerCompose \ --report-formats sarif ``` ## Understanding Output ### SARIF Structure KICS SARIF v2.1.0 includes: - **Rules**: Each query/check (1500+ built-in queries) - **Results**: Specific IaC misconfigurations found - **Properties**: - Severity: HIGH, MEDIUM, LOW, INFO - Category: Security, Best Practices, etc. - Platform: Terraform, K8s, Dockerfile, etc. - CWE mapping - Remediation guidance ### Result Categories | Category | Examples | |----------|----------| | **Access Control** | Overly permissive IAM, public resources | | **Encryption** | Unencrypted storage, weak TLS | | **Networking** | Open security groups, exposed ports | | **Secret Management** | Hardcoded credentials, exposed secrets | | **Resource Configuration** | Missing logging, backup disabled | | **Best Practices** | Missing tags, resource limits | | **Insecure Defaults** | Default passwords, debug mode | ## Advanced Features ### Custom Queries Create custom query in `custom-queries/`: ```rego # custom-queries/require_tags.rego package Cx CxPolicy[result] { resource := input.document[i].resource.aws_instance[name] not resource.tags result := { "documentId": input.document[i].id, "searchKey": sprintf("aws_instance[%s]", [name]), "issueType": "MissingAttribute", "keyExpectedValue": "Tags should be defined", "keyActualValue": "Tags are not defined" } } ``` Use custom queries: ```bash kics scan -p ./terraform \ --queries-path ./custom-queries \ --report-formats sarif ``` ### Query Information ```bash # List all queries kics list-platforms # Show query details kics show-query <query-id> # Generate queries documentation kics generate-documentation ``` ### Results Management ```bash # Generate baseline kics scan -p . --report-formats json -o baseline.json # Compare against baseline kics scan -p . --exclude-results $(cat baseline.json | jq -r '.results[].similarity_id') ``` ## Compliance Frameworks KICS maps findings to: - **CIS Benchmarks**: AWS, Azure, GCP, Kubernetes - **PCI-DSS**: Payment card industry standards - **HIPAA**: Healthcare compliance - **GDPR**: Data protection requirements - **SOC 2**: Security controls - **NIST**: Cybersecurity framework ```bash # Filter by compliance kics scan -p . --include-queries "CIS*" --report-formats sarif ``` ## Performance Optimization ```bash # Parallel scanning (default: number of CPUs) kics scan -p . --parallel 8 # Limit file size kics scan -p . --file-size-limit 1000 # KB # Exclude large directories kics scan -p . --exclude-paths "**/node_modules/**,**/.terraform/**" # Minimal UI for speed kics scan -p . --minimal-ui --silent --no-progress ``` ## Limitations - **Runtime issues**: Can't detect runtime misconfigurations - **Custom modules**: Limited visibility into external Terraform modules - **Context awareness**: May flag acceptable exceptions - **False positives**: Generic rules may not fit all use cases - **Remediation**: Provides guidance but doesn't auto-fix ## Rationalizations to Reject | Shortcut | Why It's Wrong | |----------|----------------| | "KICS found nothing = IaC is secure" | KICS has 1500+ queries but can't cover every misconfiguration | | "Suppress all LOW/MEDIUM findings" | Lower severity findings can combine to create critical risks | | "Skip IaC scanning in CI" | IaC defines infrastructure; security issues here affect entire environment | | "Only scan before deployment" | Early detection in development prevents costly late-stage fixes | | "Ignore platform-specific queries" | Platform-specific checks catch cloud provider misconfigurations | ## References - Repository: <https://github.com/Checkmarx/kics> - Documentation: <https://docs.kics.io/> - Query Library: <https://docs.kics.io/latest/queries/> - GitHub Action: <https://github.com/checkmarx/kics-github-action> - SARIF Documentation: <https://github.com/Checkmarx/kics/blob/master/docs/results.md> - CIS Benchmarks: <https://www.cisecurity.org/cis-benchmarks>