CLI Tool Commands and Parameters - Terraform and CloudFormation

After you have setup the command line interface (CLI) Infrastructure as Code (IaC) scanning tool via Docker or local executable, you're ready to start using it with Terraform and/or AWS CloudFormation Template (CFT) infrastructure. If you have questions or issues, reach out to us using the Customer Support Portal. If you're looking to use IaC with Terraform Cloud/Enterprise instead, see Integrate with Terraform Cloud/Enterprise (TFC/E) for more information.

Prerequisites

Before scanning Terraform or CFT files with the scanning tool, ensure you have the following:

• A proper setup for the CLI Scanning tool
• A user in InsightCloudSec with the Editor or greater entitlement for IaC
• An API key for your user
  • Review Users, Groups, and Roles (Administration) for more information on creating an API key via the UI
• A complete IaC Configuration

If you have questions or issues, reach out to us using the Customer Support Portal.

Command List & Parameters

The command list and parameters are the same regardless if you're using mimics via local executable or Docker.

Global Flags and Parameters

Commands

Flags and Parameters for <code>scan</code>

Exit Codes

Using mimics with Terraform/CFT

Use of the scanning tool depends on how you set it up. Below are examples using the scanning tool with each setup method.

Docker

Because the scanning tool is invoked using a public Docker image, the base command is more complicated than invoking the local executable:

bash
1
docker run [docker flags] public.ecr.aws/rapid7-insightcloudsec/ics/mimics:latest [mimics command] [mimics flags]

Scan Example

bash
1
# Generate a Terraform plan and convert it to JSON
2
terraform plan -out tf.plan
3
terraform show -json tf.plan > plan.json
4

5
# Run our IaC tool via docker
6
docker run \
7
-v $(pwd):/data \
8
-e MIMICS_BASE_URL=$ICS_BASE_URL \
9
-e MIMICS_API_KEY=$ICS_API_KEY \
10
public.ecr.aws/rapid7-insightcloudsec/ics/mimics:latest scan \
11
data/plan.json \
12
-c "Azure Checks" \
13
--report-formats all \
14
--report-path "data/reports" \
15
--no-progress

List IaC Configurations Example

bash
1
docker run
2
-v $(pwd):/data \
3
-e MIMICS_BASE_URL=$ICS_BASE_URL \
4
-e MIMICS_API_KEY=$ICS_API_KEY \
5
public.ecr.aws/rapid7-insightcloudsec/ics/mimics:latest ics-config list \
6
--no-verify
7
Config name                                         |    Total scans    |    Last scan time
8
-----------                                         |    -----------    |    --------------
9
tests config1                                       |    132            |    2022-05-21T10:43:46Z
10
AWS Config                                          |    3              |    2021-04-09T13:07:50ZZ
11
test config 4                                       |    1              |    2019-11-15T15:20:24Z
12
HIPAA Custom                                        |    4              |    2020-07-08T19:55:10Z

Local Executable

To actually use the local executable, follow the pattern ./mimics [command] [flags] for Mac or mimic.exe [command] [flags] for Windows.

Scan Example

bash
1
# Generate a Terraform plan and convert it to JSON
2
terraform plan -out tf.plan
3
terraform show -json tf.plan > plan.json
4

5
./mimics scan plan.json \
6
-c "Azure Checks" \
7
--report-formats all \
8
--report-path "data/reports" \
9
--no-progress \
10
--api-key "<my-api-key>" \
11
--base-url "http://localhost:8001/" \
12
--platform-url "http://platformdomain.com:8001/" \
13
--no-verify

Show IaC Configuration Example

bash
1
./mimics ics-config show "tests config1" \
2
--api-key "<my-api-key>" \
3
--base-url "http://localhost:8001/" \
4
--no-verify
5
Insight Name                                                          |    Description
6
------------                                                          |    -----------
7
Cloud Account without Global API Accounting Config (AWS)              |    Identify Accounts Without API Accounting Config, Such as AWS CloudTra...
8
Cloud Root Account API Access Key Present                             |    Identify Accounts With API Access Keys Present on the Root Account
9
Cloud User Account without MFA                                        |    Identify cloud user accounts which do not require two-factor authenti...
10
Cloud Account without Root Account MFA Protection                     |    Identify Accounts Which Still Have the Root Account Active Without Tw...
11
Network without Traffic Logging                                       |    Identify Networks, e.g., AWS VPCs, That Do Not Have Network Logging E...
12
API Key Unused For 90 Days                                            |    Identify API keys that have not been used within the past 90 days

Viewing CLI Scan Details in the UI

After performing a scan using the CLI tool you can view scan details through the InsightCloudSec UI. All CLI Scans will be included in the IaC Scan list and can be viewed in the same way as other scans.

Check out the Viewing Scan Results page for details on viewing your scan results within the UI, including summary details.