Skip to main content

Jenkins

Beta feature

CI/CD support for Jenkins is currently in beta for select Lacework customers. Contact your Lacework Representative for more information.

Manage Lacework API Credentials with Jenkins​

There are a variety of ways to manage credentials in Jenkins. For more information, go to the Jenkins Documentation

Collect LW_API_KEY and LW_API_SECRET​

To integrate with Jenkins, you must first collect your LW_API_KEY and LW_API_SECRET. To view this information:

  1. Log in to the Lacework Console.
  2. Click Settings > API keys.
  3. Select or create an API key.
  4. Click the download icon.
  5. Open the downloaded .json file to view your API Key and Secret.

Add LW_API_KEY and LW_API_SECRET as Credentials​

The following set of instructions add and configure global credentials in your Jenkins environment. Before implementing these credentials, check with your Jenkins admin to ensure this is your organization's method of configuration.

info

The following instructions are just an example - please follow your organization’s credential management.

note

You must have Credentials > Create permission in your Jenkins organization. This role is configured by a user with Administer permission.

Create New Credentials​

To add new credentials:

  1. Log in to Jenkins.
  2. Go to Manage Jenkins.
  3. Click Manage Credentials
  4. Click Jenkins under Stores scoped to Jenkins.
  5. Click Global credentials (unrestricted) under System.
  6. Click Add credentials. Note: this may appear as add some credentials.

Then, add LW_API_KEY and LW_API_SECRET as “Secret text” credentials. For each credential:

  1. In the Kind dropdown Secret text.
  2. In the Scope dropdown, select Global.
  3. Paste your secret in the Secret field.
  4. In the ID field, enter LW_API_KEY or LW_API_SECRET.
  5. Describe the credential.
  6. Click Create.

Add Secret Credential in Jenkins

Add the Credentials to your Job Configuration​

Once you have added LW_API_KEY and LW_API_SECRET as secret text credentials, you must add them to your job configuration:

  1. Open your Jenkins job configuration.
  2. Go to the Build environment section.
  3. Select Use secret text(s) or file(s).
  4. Under Bindings, click Add.

For each credential,

  1. In the Variable field, enter the Variable name (for example, LW_API_KEY).
  2. In the Credentials dropdown, select the credential that corresponds with the named variable.
  3. Click Save.

Add credentials to your Jenkins job configuration

Use the lacework/codesec-iac Image for IaC Scanning​

Prepare an env.list File​

The lacework/codesec-iac image runs in Docker, but it relies on a number of environment variables being passed to it by Jenkins. This can be achieved by creating an env.list file in the workspace with the required variables and then having Docker use that for its environment.

The following script can be used:

#!/bin/bash
## Provide Lacework credentials
echo "LW_ACCOUNT=AcmeCorporation" > env.list
echo "LW_API_KEY=${LW_API_KEY}" >> env.list
echo "LW_API_SECRET=${LW_API_SECRET}" >> env.list
echo "SCAN_COMMAND=tf-scan" >> env.list
echo "WORKSPACE=src" >> env.list
## Provide Jenkins build details
env | grep '^BRANCH_\|^CHANGE_\|^TAG_\|^BUILD_\|^JOB_\|^JENKINS_\|^GIT_' >> env.list
caution

The #!/bin/bash declaration at the top of the script ensures that the commands are interpreted as bash. Don't leave it out!

Invoke Docker​

Your can then invoke Docker in your Jenkins job with usage such as:

docker run --env-file env.list -v "$(pwd):/app/src" lacework/codesec-iac:latest

Define an Unstable Result​

To have your job reach an “unstable” result, you can add an entry for EXIT_FLAG that defines your threshold for IaC violations in the env.list file.

For example, to make a count of 2 violations of at least High severity be flagged as a problem, set the variable as:

echo "EXIT_FLAG=High=2" >> env.list

Then in your job configuration, define an exit code of 2 to indicate instability. Add an exit code for the build to indicate instability

Available Commands​

For available commands, refer to CI/CD Usage.