image-scanner-with-trivy 1.2.1 → 1.4.0

package/.jsii

@@ -3518,7 +3518,7 @@
   },
   "name": "image-scanner-with-trivy",
   "readme": {
-    "markdown": "# image-scanner-with-trivy\n\n## Detail Pages\n\nThe detail blog is [here](https://dev.to/aws-builders/container-image-scanning-with-trivy-in-aws-cdk-151h).\n\nTo my surprise, this library was featured on the ecosystem page of [Trivy's official documentation](https://aquasecurity.github.io/trivy/latest/ecosystem/ide/#image-scanner-with-trivy-community)!\n\n## What is\n\nThis is an AWS CDK Construct that allows you to **scan container images with Trivy in CDK deployment layer**.\n\nIf it detects vulnerabilities, it can **prevent the image from being pushed to the ECR for the application**.\n\nSince it takes an `imageUri` for ECR as an argument, it can also be used to **simply scan an existing image in the repository**.\n\n## Trivy\n\n[Trivy](https://github.com/aquasecurity/trivy) is a comprehensive and versatile security scanner.\n\n## Usage\n\n- Install\n\n```sh\nnpm install image-scanner-with-trivy\n```\n\n- CDK Code\n\n```ts\nimport { ImageScannerWithTrivy } from 'image-scanner-with-trivy';\n\nconst repository = new Repository(this, 'ImageRepository', {\n  removalPolicy: RemovalPolicy.DESTROY,\n  autoDeleteImages: true,\n});\n\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\n// Add properties you want for trivy options (ignoreUnfixed, severity, scanners, trivyIgnore, etc).\nconst imageScanner = new ImageScannerWithTrivy(this, 'ImageScannerWithTrivy', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n});\n\n// By adding `addDependency`, if the vulnerabilities are detected by `ImageScannerWithTrivy`, the following `ECRDeployment` will not be executed, deployment will fail.\nconst ecrDeployment = new ECRDeployment(this, 'DeployImage', {\n  src: new DockerImageName(image.imageUri),\n  dest: new DockerImageName(`${repository.repositoryUri}:latest`),\n});\necrDeployment.node.addDependency(imageScanner);\n```\n\n## API Reference\n\nAPI Reference is [here](./API.md#api-reference-).\n"
+    "markdown": "# image-scanner-with-trivy\n\n## Detail Pages\n\nThe detail blog is [here](https://dev.to/aws-builders/container-image-scanning-with-trivy-in-aws-cdk-151h).\n\nTo my surprise, this library was featured on the ecosystem page of [Trivy's official documentation](https://aquasecurity.github.io/trivy/latest/ecosystem/ide/#image-scanner-with-trivy-community)!\n\n## What is\n\nThis is an AWS CDK Construct that allows you to **scan container images with Trivy in CDK deployment layer**.\n\nIf it detects vulnerabilities, it can **prevent the image from being pushed to the ECR for the application**.\n\nSince it takes an `imageUri` for ECR as an argument, it can also be used to **simply scan an existing image in the repository**.\n\n## Trivy\n\n[Trivy](https://github.com/aquasecurity/trivy) is a comprehensive and versatile security scanner.\n\n## Usage\n\n### Install\n\n```sh\nnpm install image-scanner-with-trivy\n```\n\n### CDK Code\n\nThe following code is a minimal example.\n\n```ts\nimport { ImageScannerWithTrivy } from 'image-scanner-with-trivy';\n\nconst repository = new Repository(this, 'ImageRepository', {\n  removalPolicy: RemovalPolicy.DESTROY,\n  autoDeleteImages: true,\n});\n\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\n// Add properties you want for trivy options (ignoreUnfixed, severity, scanners, trivyIgnore, etc).\nconst imageScanner = new ImageScannerWithTrivy(this, 'ImageScannerWithTrivy', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n});\n\n// By adding `addDependency`, if the vulnerabilities are detected by `ImageScannerWithTrivy`, the following `ECRDeployment` will not be executed, deployment will fail.\nconst ecrDeployment = new ECRDeployment(this, 'DeployImage', {\n  src: new DockerImageName(image.imageUri),\n  dest: new DockerImageName(`${repository.repositoryUri}:latest`),\n});\necrDeployment.node.addDependency(imageScanner);\n```\n\n### Scan Logs Output\n\nIf you output the scan logs to other than the default log group, you can specify the `scanLogsOutput` option.\n\nThis option is useful when you want to choose where to output the scan logs.\n\nCurrently, CloudWatch Logs is only supported as an output destination.\n\n```ts\nimport { ImageScannerWithTrivy, ScanLogsOutput } from 'image-scanner-with-trivy';\n\nconst repository = new Repository(this, 'ImageRepository', {\n  removalPolicy: RemovalPolicy.DESTROY,\n  autoDeleteImages: true,\n});\n\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\nconst imageScanner = new ImageScannerWithTrivy(this, 'ImageScannerWithTrivy', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n  // Use `ScanLogsOutput.cloudWatchLogs` method to specify the log group.\n  scanLogsOutput: ScanLogsOutput.cloudWatchLogs({ logGroup: new LogGroup(this, 'LogGroup') }),\n});\n```\n\n### Default Log Group\n\nIf you customize the default log group for Scanner Lambda, you can specify the `defaultLogGroupRemovalPolicy` and `defaultLogGroupRetentionDays` options.\nCurrently, only changing the removal policy and retention days are supported.\n\nIf the default log group is already created in your AWS Account and you specify the `defaultLogGroupRemovalPolicy` and `defaultLogGroupRetentionDays` options, the deployment will fail because of a conflict with the log group name.\n\n```ts\nimport { ImageScannerWithTrivy } from 'image-scanner-with-trivy';\n\nconst repository = new Repository(this, 'ImageRepository', {\n  removalPolicy: RemovalPolicy.DESTROY,\n  autoDeleteImages: true,\n});\n\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\nnew ImageScannerWithTrivy(this, 'ImageScannerWithTrivy', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n  // Change the default log group removal policy to `Destroy`.\n  defaultLogGroupRemovalPolicy: RemovalPolicy.DESTROY,\n  // Change the default log group retention days to `One Year`.\n  defaultLogGroupRetentionDays: RetentionDays.ONE_YEAR,\n});\n```\n\nIf you use ImageScannerWithTrivy construct multiple times in the same stack, you have to set the same values for `defaultLogGroupRemovalPolicy` and `defaultLogGroupRetentionDays` for each construct.\nWhen you set the different values for each construct, the first one will be applied to all ImageScannerWithTrivy constructs in the same stack and warning message will be displayed.\n\nThe following code will produce warning message because of the different values of `defaultLogGroupRemovalPolicy` and `defaultLogGroupRetentionDays` for each construct.\n\n```ts\nimport { ImageScannerWithTrivy, ScanLogsOutput } from 'image-scanner-with-trivy';\n\nconst repository = new Repository(this, 'ImageRepository', {\n  removalPolicy: RemovalPolicy.DESTROY,\n  autoDeleteImages: true,\n});\n\nconst image = new DockerImageAsset(this, 'DockerImage', {\n  directory: resolve(__dirname, './'),\n});\n\nnew ImageScannerWithTrivy(this, 'ImageScannerWithTrivy', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n  // The following options are applied to all ImageScannerWithTrivy constructs in the same stack.\n  defaultLogGroupRemovalPolicy: RemovalPolicy.DESTROY,\n  defaultLogGroupRetentionDays: RetentionDays.ONE_YEAR,\n});\n\n// NG example\n// Once you specify the defaultLogGroupRemovalPolicy and defaultLogGroupRetentionDays, you have to set the same values for each construct.\nnew ImageScannerWithTrivy(this, 'ImageScannerWithTrivyWithDifferentDefaultLogGroupOptions', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n  // The following options are different from the above construct, and warning message will be displayed when synthesizing the stack.\n  defaultLogGroupRemovalPolicy: RemovalPolicy.RETAIN, // This should be `RemovalPolicy.DESTROY` as the above construct.\n  defaultLogGroupRetentionDays: RetentionDays.ONE_MONTH, // This should be `RetentionDays.ONE_YEAR` as the above construct.\n});\nnew ImageScannerWithTrivy(this, 'ImageScannerWithTrivyWithNoDefaultLogGroupOptions', {\n  imageUri: image.imageUri,\n  repository: image.repository,\n  // You should specify the defaultLogGroupRemovalPolicy and defaultLogGroupRetentionDays if you have already set the values.\n});\n```\n\n## API Reference\n\nAPI Reference is [here](./API.md#api-reference-).\n"
   },
   "repository": {
     "type": "git",
@@ -3531,6 +3531,76 @@
     }
   },
   "types": {
+    "image-scanner-with-trivy.CloudWatchLogsOutputOptions": {
+      "assembly": "image-scanner-with-trivy",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Output configuration for scan logs to CloudWatch Logs."
+      },
+      "fqn": "image-scanner-with-trivy.CloudWatchLogsOutputOptions",
+      "interfaces": [
+        "image-scanner-with-trivy.ScanLogsOutputOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/types.ts",
+        "line": 18
+      },
+      "name": "CloudWatchLogsOutputOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/types.ts",
+            "line": 19
+          },
+          "name": "logGroupName",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/types:CloudWatchLogsOutputOptions"
+    },
+    "image-scanner-with-trivy.CloudWatchLogsOutputProps": {
+      "assembly": "image-scanner-with-trivy",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Configuration for scan logs output to CloudWatch Logs log group."
+      },
+      "fqn": "image-scanner-with-trivy.CloudWatchLogsOutputProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/image-scanner-with-trivy.ts",
+        "line": 70
+      },
+      "name": "CloudWatchLogsOutputProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The log group to output scan logs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/image-scanner-with-trivy.ts",
+            "line": 74
+          },
+          "name": "logGroup",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_logs.ILogGroup"
+          }
+        }
+      ],
+      "symbolId": "src/image-scanner-with-trivy:CloudWatchLogsOutputProps"
+    },
     "image-scanner-with-trivy.ImageConfigScanners": {
       "assembly": "image-scanner-with-trivy",
       "docs": {
@@ -3542,7 +3612,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "src/image-scanner-with-trivy.ts",
-        "line": 45
+        "line": 62
       },
       "members": [
         {
@@ -3574,7 +3644,7 @@
         },
         "locationInModule": {
           "filename": "src/image-scanner-with-trivy.ts",
-          "line": 214
+          "line": 315
         },
         "parameters": [
           {
@@ -3600,7 +3670,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/image-scanner-with-trivy.ts",
-        "line": 213
+        "line": 314
       },
       "name": "ImageScannerWithTrivy",
       "symbolId": "src/image-scanner-with-trivy:ImageScannerWithTrivy"
@@ -3615,7 +3685,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/image-scanner-with-trivy.ts",
-        "line": 50
+        "line": 118
       },
       "name": "ImageScannerWithTrivyProps",
       "properties": [
@@ -3628,7 +3698,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 54
+            "line": 122
           },
           "name": "imageUri",
           "type": {
@@ -3645,13 +3715,51 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 61
+            "line": 129
           },
           "name": "repository",
           "type": {
             "fqn": "aws-cdk-lib.aws_ecr.IRepository"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- Scanner Lambda creates the default log group(`/aws/lambda/${functionName}`).",
+            "remarks": "If you use ImageScannerWithTrivy construct multiple times in the same stack, you cannot set different removal policies for the default log group.\nSee `Notes` section in the README for more details.",
+            "stability": "stable",
+            "summary": "The removal policy to apply to Scanner Lambda's default log group."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/image-scanner-with-trivy.ts",
+            "line": 285
+          },
+          "name": "defaultLogGroupRemovalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- Scanner Lambda creates the default log group(`/aws/lambda/${functionName}`) and log events never expire.",
+            "remarks": "If you use ImageScannerWithTrivy construct multiple times in the same stack, you cannot set different retention days for the default log group.\nSee `Notes` section in the README for more details.",
+            "stability": "stable",
+            "summary": "The number of days log events are kept in Scanner Lambda's default log group."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/image-scanner-with-trivy.ts",
+            "line": 295
+          },
+          "name": "defaultLogGroupRetentionDays",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_logs.RetentionDays"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3664,7 +3772,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 135
+            "line": 203
           },
           "name": "exitCode",
           "optional": true,
@@ -3684,7 +3792,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 153
+            "line": 221
           },
           "name": "exitOnEol",
           "optional": true,
@@ -3704,7 +3812,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 72
+            "line": 140
           },
           "name": "ignoreUnfixed",
           "optional": true,
@@ -3724,7 +3832,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 120
+            "line": 188
           },
           "name": "imageConfigScanners",
           "optional": true,
@@ -3748,7 +3856,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 196
+            "line": 264
           },
           "name": "memorySize",
           "optional": true,
@@ -3767,7 +3875,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 207
+            "line": 275
           },
           "name": "platform",
           "optional": true,
@@ -3775,6 +3883,25 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- scan logs output to default log group created by Scanner Lambda(`/aws/lambda/${functionName}`)",
+            "remarks": "By default, scan logs are output to default log group created by Scanner Lambda.\n\nSpecify this if you want to send scan logs to other than the default log group.\n\nCurrently, only `cloudWatchLogs` is supported.",
+            "stability": "stable",
+            "summary": "Configuration for scan logs output."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/image-scanner-with-trivy.ts",
+            "line": 308
+          },
+          "name": "scanLogsOutput",
+          "optional": true,
+          "type": {
+            "fqn": "image-scanner-with-trivy.ScanLogsOutput"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3787,7 +3914,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 103
+            "line": 171
           },
           "name": "scanners",
           "optional": true,
@@ -3812,7 +3939,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 89
+            "line": 157
           },
           "name": "severity",
           "optional": true,
@@ -3838,7 +3965,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/image-scanner-with-trivy.ts",
-            "line": 183
+            "line": 251
           },
           "name": "trivyIgnore",
           "optional": true,
@@ -3854,6 +3981,135 @@
       ],
       "symbolId": "src/image-scanner-with-trivy:ImageScannerWithTrivyProps"
     },
+    "image-scanner-with-trivy.ScanLogsOutput": {
+      "abstract": true,
+      "assembly": "image-scanner-with-trivy",
+      "docs": {
+        "stability": "stable",
+        "summary": "Represents the output of the scan logs."
+      },
+      "fqn": "image-scanner-with-trivy.ScanLogsOutput",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        }
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/image-scanner-with-trivy.ts",
+        "line": 80
+      },
+      "methods": [
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "Scan logs output to CloudWatch Logs log group."
+          },
+          "locationInModule": {
+            "filename": "src/image-scanner-with-trivy.ts",
+            "line": 84
+          },
+          "name": "cloudWatchLogs",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "image-scanner-with-trivy.CloudWatchLogsOutputProps"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "image-scanner-with-trivy.ScanLogsOutput"
+            }
+          },
+          "static": true
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Returns the output configuration for scan logs."
+          },
+          "locationInModule": {
+            "filename": "src/image-scanner-with-trivy.ts",
+            "line": 91
+          },
+          "name": "bind",
+          "parameters": [
+            {
+              "name": "grantee",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "image-scanner-with-trivy.ScanLogsOutputOptions"
+            }
+          }
+        }
+      ],
+      "name": "ScanLogsOutput",
+      "symbolId": "src/image-scanner-with-trivy:ScanLogsOutput"
+    },
+    "image-scanner-with-trivy.ScanLogsOutputOptions": {
+      "assembly": "image-scanner-with-trivy",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Output configurations for scan logs."
+      },
+      "fqn": "image-scanner-with-trivy.ScanLogsOutputOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/types.ts",
+        "line": 11
+      },
+      "name": "ScanLogsOutputOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/types.ts",
+            "line": 12
+          },
+          "name": "type",
+          "type": {
+            "fqn": "image-scanner-with-trivy.ScanLogsOutputType"
+          }
+        }
+      ],
+      "symbolId": "src/types:ScanLogsOutputOptions"
+    },
+    "image-scanner-with-trivy.ScanLogsOutputType": {
+      "assembly": "image-scanner-with-trivy",
+      "docs": {
+        "stability": "stable",
+        "summary": "Enum for ScanLogsOutputType."
+      },
+      "fqn": "image-scanner-with-trivy.ScanLogsOutputType",
+      "kind": "enum",
+      "locationInModule": {
+        "filename": "src/types.ts",
+        "line": 4
+      },
+      "members": [
+        {
+          "docs": {
+            "stability": "stable"
+          },
+          "name": "CLOUDWATCH_LOGS"
+        }
+      ],
+      "name": "ScanLogsOutputType",
+      "symbolId": "src/types:ScanLogsOutputType"
+    },
     "image-scanner-with-trivy.Scanners": {
       "assembly": "image-scanner-with-trivy",
       "docs": {
@@ -3865,7 +4121,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "src/image-scanner-with-trivy.ts",
-        "line": 33
+        "line": 50
       },
       "members": [
         {
@@ -3907,7 +4163,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "src/image-scanner-with-trivy.ts",
-        "line": 20
+        "line": 37
       },
       "members": [
         {
@@ -3945,6 +4201,6 @@
       "symbolId": "src/image-scanner-with-trivy:Severity"
     }
   },
-  "version": "1.2.1",
-  "fingerprint": "sO9TM7RVYrHjLPhrmKsR+ewIw5COtYPO1tHhw+VO+Nk="
+  "version": "1.4.0",
+  "fingerprint": "GHI0DiXFw/BG1uuUoyMU3ciRMGMifdtqtkPqVrDGmYY="
 }