Qualys IaC Security Integration with Jenkins

Qualys IaC Security CLI shifts compliance validation earlier in the development pipeline by scanning infrastructure-as-code templates before deployment rather than after resources are live in the cloud. The solution evaluates configuration files against predefined controls to identify misconfigurations during the build phase, enabling teams to prevent misconfigurations before they happen. This approach reduces remediation costs and risk exposure by catching security issues when they are cheapest to fix, while integrations with popular CI/CD tools like Jenkins, GitHub, and GitLab embed scanning directly into existing development workflows.

The security scans in the current continuous integration and continuous deployment (CI/CD) environment are performed on cloud resources after deployment. This approach focuses on securing cloud resources once they are provisioned in the respective cloud accounts and helps identify configuration issues in already deployed resources.

With the introduction of the Infrastructure as Code (IaC) security feature in Qualys TotalCloud, organizations can validate IaC templates during development. The IaC Security feature evaluates templates against security and compliance policies, providing developers with visibility into configuration issues and policy violations during template creation and modification stages.

Qualys TotalCloud integrates with Jenkins to scan and secure your IaC templates using the Jenkins pipeline. It continuously verifies security misconfigurations against TotalCloud controls and displays the misconfigurations for each run. With continuous visibility of the security posture of your IaC templates at the Jenkins pipeline, you can plan for remediation to stay secure post deployment.

For supported templates, other integrations, and features of Cloud IaC Security, refer to TotalCloud Online Help and TotalCloud API User Guide.

Scan IaC Templates at Jenkins

The Jenkins integration allows you to perform IaC scans on your infrastructure-as-code templates. You can perform an IaC scan on either of the following:

• The entire git repository.
• The templates that were newly added or updated to the branch.

The results are generated on the build console that provides you with proactive visibility into the security of your IaC templates residing in git repositories.

Integration Methods

You can integrate Qualys IaC Security with Jenkins using one of the following methods:

Method 1: Using Pipeline Job

This method uses a Jenkins Pipeline project with the Qualys IaC Security CLI Docker image. You configure environment variables as credentials in Jenkins, set up a git repository, and run a pipeline script that pulls the Qualys Docker container to perform the scan. This method provides flexibility with scripted or declarative pipelines.

Follow this workflow:

1. Using Pipeline Job (Overview and Prerequisites)
2. Configure Environment Variables
3. Configure Git Repositories
4. Configure Pipeline Job
5. View Scan Output

Method 2: Using Freestyle Project with Plugin

This method uses the Qualys IaC Security Jenkins plugin, which you install directly from the Jenkins Plugin Manager. You configure system-level settings with your Qualys credentials, create a Freestyle project, and add the Qualys IaC Scan build step. This method provides a GUI-based configuration with built-in scan reports in the Jenkins interface.

Follow this workflow:

1. Using Freestyle Project with Plugin (Overview and Prerequisites)
2. Configure the Plugin
3. Configure System
4. Run IaC Scan
5. View Scan Output