Qualys IaC Security Integration for GitLab
Qualys IaC Security CLI shifts compliance validation earlier in the development pipeline by scanning infrastructure-as-code templates before deployment rather than after resources are live in the cloud. The solution evaluates configuration files against predefined controls to identify misconfigurations during the build phase, enabling teams to prevent misconfigurations before they happen. This approach reduces remediation costs and risk exposure by catching security issues when they are cheapest to fix, while integrations with popular CI/CD tools like Jenkins, GitHub, and GitLab embed scanning directly into existing development workflows.
The security scans in the current continuous integration and continuous deployment (CI/CD) environment are performed on cloud resources after deployment. This approach focuses on securing cloud resources once they are provisioned in the respective cloud accounts and helps identify configuration issues in already deployed resources.
With the introduction of the Infrastructure as Code (IaC) security feature in Qualys TotalCloud, organizations can validate IaC templates during development. The IaC Security feature evaluates templates against security and compliance policies, providing developers with visibility into configuration issues and policy violations during template creation and modification stages.
Qualys TotalCloud integrates with GitHub to secure Git repositories using GitHub Actions, enabling scans to IaC templates stored in GitHub repositories. The integration evaluates templates against Qualys TotalCloud security controls and reports detected misconfigurations for each workflow run. This provides visibility into the security posture of IaC templates stored in repositories and helps teams plan remediation activities accordingly. Follow this guide for more details.
For suppor
For supported templates, other integrations, and features of Cloud IaC Security, refer to TotalCloud Online Help and TotalCloud API User Guide.
Scan IaC Template at GitLab
The GitLab integration allows you to perform IaC scans at the GitHub repositories on the push and merge requests. It checks the security issues and displays the failed checks as pipeline annotations. We provide you with a pipeline script and options that can be configured to run based on various triggers.
You can perform an IaC scan on either of the following:
- The entire branch repository where the push, manual, or scheduled event was performed.
- The templates that were newly added to the branch.
The results are generated within GitLab pipeline output that provides you with proactive visibility into the security of your IaC templates residing in GitHub repositories.
Prerequisites
- Ensure that you have a valid Qualys subscription to the Qualys Cloud Security Assessment application.
- Before you trigger IaC scans in GitLab, ensure that you configure environment variables that are used in the script.