Trivy plugin for integration with Google Cloud Security Command Center
Trivy's options need to be passed after --. Trivy receives a target directory containing IaC files
Set scc plugin as Trivy's current default plugin by exporting an environment variable
export TRIVY_RUN_AS_PLUGIN=aqua
trivy <target>
trivy <target>
trivy --severities CRITICAL,HIGH <target>
| Argument | Purpose | Example Usage |
|---|---|---|
--debug |
Get more detailed output as Trivy runs. | |
--severities |
The Severities that you are interested in. | --severities CRITICAL,HIGH,UKNOWN |
--tags |
Arbitrary tags to be stored with the scan. | --tags 'BUILD_HOST=$HOSTNAME,foo=bar' |
The only explicitly required environment variables are
| Variable | Purpose |
|---|---|
Trivy will attempt to resolve the following details from the available environment variables;
- repository name
- branch name
- commit id
- committing user
- build system
There are some special case env vars;
| Variable | Purpose |
|---|---|
| OVERRIDE_REPOSITORY | Use this environment variable to explicitly specify the repository used by Trivy |
| FALLBACK_REPOSITORY | Use this environment variable as a backup if no other repository env vars can be found |
| OVERRIDE_BRANCH | Use this environment variable to explicitly specify the branch used by Trivy |
| FALLBACK_BRANCH | Use this environment variable as a backup if no other branch env vars can be found |
| OVERRIDE_BUILDSYSTEM | Use this environment variable to explicitly specify the build system |
To deploy a new version, create a new tag from master
make update-plugin
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent