diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 71827c335c..9d82e30ddf 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -118,36 +118,21 @@ jobs: env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + TRIVY_SECRET_CONFIG: "./security/code/trivy-secret.yaml" with: scan-type: "fs" ignore-unfixed: false - # PR/push: print findings to the run log and fail the check so - # engineers see issues before merging. Schedule/manual matrix runs: - # emit SARIF for upload to the Security tab. + # PR/push: only scan for secrets (block leaked credentials before merge). + # Schedule/manual: full scan (vuln + secret + misconfig) with SARIF upload + # to the Security tab for triage. CVEs are tracked nightly, not per-PR. + scanners: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'vuln,secret,misconfig' || 'secret' }} format: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'sarif' || 'table' }} output: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'trivy-results.sarif' || '' }} exit-code: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '0' || '1' }} severity: "CRITICAL,HIGH,MEDIUM,LOW" trivyignores: "./security/code/.trivyignore" - # Skip private keys used only for local testing, not production: - # - tools/osquery/in-a-box/osquery/fleet.key: TLS key for the "Fleet in a box" demo - # - tools/osquery/fleet.key: TLS key for the standalone osquery dev sandbox - # - orbit/pkg/insecure/proxy.go: TLS key used when running orbit with `--insecure` mode for development/testing. - # - ee/orbit/pkg/httpsigproxy/httpsigproxy.go: TLS key only used for osquery to orbit _local_ communication - # (for injection of HTTP signatures for the TPM-backed feature in Linux). - # - website/config/custom.js: commented-out Stripe test-mode placeholders shown as example config. - # - ee/fleet-agent-downloader/config/custom.js: same Sails template, commented-out Stripe test placeholders. - # - tools/test-orbit-mtls/client.key: client private key used only by local/test mTLS tooling. - # - tools/smtp4dev/fleet.key: TLS key for the local smtp4dev development mail server. - skip-files: | - tools/osquery/in-a-box/osquery/fleet.key - tools/osquery/fleet.key - tools/smtp4dev/fleet.key - orbit/pkg/insecure/proxy.go - ee/orbit/pkg/httpsigproxy/httpsigproxy.go - website/config/custom.js - ee/fleet-agent-downloader/config/custom.js - tools/test-orbit-mtls/client.key + # Test/dev keys and Sails placeholders are handled by trivy-secret.yaml. + # Production files use targeted path+regex allow-rules in trivy-secret.yaml. - name: Upload Trivy scan results to GitHub Security tab # Only upload on schedule/manual runs. PR/push uploads register diff --git a/infrastructure/loadtesting/terraform/shared/elasticsearch.tf b/infrastructure/loadtesting/terraform/shared/elasticsearch.tf index ee6093387a..6673ff5c11 100644 --- a/infrastructure/loadtesting/terraform/shared/elasticsearch.tf +++ b/infrastructure/loadtesting/terraform/shared/elasticsearch.tf @@ -217,7 +217,7 @@ resource "aws_alb_listener" "elasticsearch" { load_balancer_arn = aws_alb.main.arn port = 9200 protocol = "HTTPS" - ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08" + ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" certificate_arn = aws_acm_certificate_validation.fleetdm_com.certificate_arn default_action { @@ -240,7 +240,7 @@ resource "aws_alb_listener" "elasticapm" { load_balancer_arn = aws_alb.main.arn port = 8200 protocol = "HTTPS" - ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08" + ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" certificate_arn = aws_acm_certificate_validation.fleetdm_com.certificate_arn default_action { @@ -260,7 +260,7 @@ resource "aws_alb_listener" "kibana" { load_balancer_arn = aws_alb.main.arn port = 5601 protocol = "HTTPS" - ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08" + ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" certificate_arn = aws_acm_certificate_validation.fleetdm_com.certificate_arn default_action { diff --git a/security/code/trivy-secret.yaml b/security/code/trivy-secret.yaml new file mode 100644 index 0000000000..7c3a22baf3 --- /dev/null +++ b/security/code/trivy-secret.yaml @@ -0,0 +1,96 @@ +# Trivy secret scanning configuration. +# Docs: https://trivy.dev/docs/latest/scanner/secret/ +# +# Every suppressed file is listed explicitly. Production files also require +# a content-specific regex so new real secrets in the same file still trigger. + +allow-rules: + + # ---- Test/dev private keys and TLS certs (not production) ---- + + - id: test-key-osquery-iab + path: ^tools/osquery/in-a-box/osquery/fleet.key$ + + - id: test-key-osquery + path: ^tools/osquery/fleet.key$ + + - id: test-key-smtp4dev + path: ^tools/smtp4dev/fleet.key$ + + - id: test-key-orbit-mtls + path: ^tools/test-orbit-mtls/client.key$ + + - id: test-key-intermediate-ca + path: ^tools/test-certs/intermediate-ca/intermediate.key.pem$ + + - id: test-key-root-ca + path: ^tools/test-certs/root-ca/root-ca.key.pem$ + + - id: test-key-server-cert + path: ^tools/test-certs/server/server.key.pem$ + + - id: test-key-upgrade + path: ^test/upgrade/fleet.key$ + + - id: test-key-service-testdata + path: ^server/service/testdata/client.key$ + + - id: test-key-cryptoutil-rsa + path: ^server/mdm/cryptoutil/testdata/pkcs8-rsa.key$ + + - id: test-key-cryptoutil-x25519 + path: ^server/mdm/cryptoutil/testdata/pkcs8-x25519.key$ + + - id: test-key-certificate + path: ^pkg/certificate/testdata/test.key$ + + - id: test-key-client-testdata + path: ^client/testdata/client.key$ + + - id: test-key-insecure-proxy + path: ^orbit/pkg/insecure/proxy.go$ + + - id: test-key-httpsigproxy + path: ^ee/orbit/pkg/httpsigproxy/httpsigproxy.go$ + + # ---- Production files (path + content-specific regex) ---- + + - id: serve-dev-license-jwts + description: "Hardcoded dev/expired license JWTs for --dev_license flag" + path: "^cmd/fleet/serve\\.go$" + regex: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9\\." + + - id: calendars-gcp-placeholder + description: "GCP service account JSON placeholder shown in the UI" + path: "^frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars\\.tsx$" + regex: "fleet-in-your-calendar" + + - id: sails-fake-stripe-website + description: "Placeholder Stripe keys in website Sails config" + path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$" + regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)" + + - id: sails-fake-stripe-agent-downloader + description: "Placeholder Stripe keys in fleet-agent-downloader Sails config" + path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$" + regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)" + + - id: sails-fake-stripe-vuln-dashboard + description: "Placeholder Stripe keys in vulnerability-dashboard Sails config" + path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs|ee/vulnerability-dashboard/assets/js/utilities/open-stripe-checkout\\.js)$" + regex: "(sk_test_Zzd814|pk_test_Zzd814|pk_test_Qz5RfD|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)" + + - id: sails-fake-sendgrid-website + description: "Placeholder SendGrid key in website Sails config" + path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$" + regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU" + + - id: sails-fake-sendgrid-agent-downloader + description: "Placeholder SendGrid key in fleet-agent-downloader Sails config" + path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$" + regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU" + + - id: sails-fake-sendgrid-vuln-dashboard + description: "Placeholder SendGrid key in vulnerability-dashboard Sails config" + path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs)$" + regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"