Method 1: Using Pipeline Job
This method uses a Jenkins Pipeline project with the Qualys IaC Security CLI Docker image to scan your IaC templates. You configure environment variables as credentials in Jenkins, set up a git repository using Pipeline Syntax, and create a pipeline script that pulls the Qualys Docker container to perform the scan.
This approach provides flexibility with scripted or declarative pipelines, and the scan results are generated as an artifact file in the build console.
Prerequisites
Before you begin, ensure that the following prerequisites are met:
- Ensure that you have a valid docker pipeline plugin installed.
- Ensure to configure environment variables used in the pipeline script before you run the pipeline job in Jenkins. For more info, refer to Configure Environment Variables.
- To auto-trigger a Jenkins pipeline job, ensure that you install a specific Source Code Management (SCM) plugin, for example, the Bitbucket plugin or Bitbucket Server Integration. For auto-trigger, the pipeline job must include a Jenkins file.
- Docker must be installed on the Jenkins agent node.
- Ensure that you have a valid Qualys TotalCloud Security Assessment application subscription.