hosting custom policies on server side

[bakuljajan]

Description

I'm only aware of the vuln database being supported to be hosted in trivy server. I would like to know if custom policies can also be hosted using trivy server. This should simplify distribution as we don't need to copy the rego files to each user.

Target

Filesystem

Scanner

Misconfiguration

[simar7]

Yes you can pass --checks-bundle-repository to a custom URL.

[knqyf263]

Misconfiguration scanning is performed on the client side. Otherwise, a client needs to send all the IaC files, which may include sensitive information, to the server.
Another benefit of the client/server mode is caching. In image scanning, the server stores the analysis result in the cache per layer, and the client can skip analyzing layers in subsequent scans. This is very useful for vulnerability scanning but not for misconfiguration scanning. In misconfiguration scanning, we need to cache the IaC file contents. In addition, filesystem scanning doesn't fit for cache.

For the above reasons, misconfiguration scanning (and secret scanning for the same reasons) doesn't support the client/server mode.

@simar7 @nikpivkin I think we should update the document.

• Removing AWS from the table
• Changing Config to unsupported in the table
• Adding a new table for supported scanners

[simar7]

Ah I see what you mean @bakuljajan - @knqyf263 correct me if I'm wrong but in this case could you specify the experimental --cache-backend flag within trivy server to a custom path where you maintain it plus set up --skip-check-update within each trivy client to use the custom cache backend?

That way the the checks from the custom backend will be used and the checks bundle will not be downloaded by each of the trivy clients.

[simar7]

Sorry I just read your comment above @knqyf263 - it makes sense to me but I'm still curious if what I proposed could work or there are limitations to how a custom cache backend is used today?

[simar7]

Created #7177 to update docs.

[knqyf263]

There are two types of artifacts in the cache directory today.

1. Scan cache (analysis cache)
   • Store analysis results to speed up subsequent scans
     • Vulnerability scanner: A list of installed packages (name, version, license, etc.)
     • Misconfiguration scanner: Misconfiguration results
     • Secret scanner: Masked secret results
     • License scanner: Same as the vulnerability scanner
2. DB, etc.
   • Vulnerability DB
   • Java DB
   • Checks Bundle

--cache-backend is actually --scan-cache-backend (we might want to rename it for clarity). The flag doesn't affect the DB and bundle.

[nikpivkin]

We will change the documentation to clarify some details when scanning for misconfigurations in client/server mode.

Track #7177