Mengintegrasikan validasi IaC dengan GitHub Actions
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Anda dapat menggunakan tindakan Analyze Code Security untuk memvalidasi infrastruktur sebagai kode (IaC) yang merupakan bagian dari alur kerja GitHub Actions Anda. Memvalidasi IaC memungkinkan Anda menentukan apakah definisi resource Terraform Anda melanggar kebijakan organisasi dan detektor Security Health Analytics yang ada yang diterapkan ke resource Google Cloud Anda.
Konfigurasi Workload Identity Federation dengan penyedia identitas GitHub Anda. Untuk
mendapatkan petunjuk, lihat
Workload Identity Federation.
Dapatkan URL untuk token ID Workload Identity Federation Anda. Misalnya, https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID.
Pertimbangkan hal berikut:
PROJECT_NUMBER adalah nomor project untuk
projectGoogle Cloud tempat Anda menyiapkan Workload Identity Federation.
- name: Create Terraform Plan
id: plan
run: terraform plan -out=TF_PLAN_FILE
Ganti TF_PLAN_FILE dengan nama untuk file rencana Terraform. Contoh, myplan.tfplan.
Konversikan file rencana Anda ke dalam format JSON:
- name: Convert Terraform Plan to JSON
id: convert
run: terraform show -no-color -json TF_PLAN_FILE > TF_PLAN_JSON_FILE
Ganti TF_PLAN_JSON_FILE dengan nama untuk file rencana Terraform, dalam format JSON. Contoh, mytfplan.json.
Menambahkan tindakan ke alur kerja GitHub Actions Anda
Di repositori GitHub, buka alur kerja Anda.
Buka editor alur kerja.
Di sidebar GitHub Marketplace, telusuri Analyze Code Security.
Di bagian Penginstalan, salin sintaksisnya.
Tempelkan sintaksis sebagai langkah baru ke dalam alur kerja Anda.
Ganti nilai berikut:
workload_identity_provider dengan link ke URL untuk token ID Federasi Identitas Beban Kerja Anda.
service_account dengan alamat email akun layanan yang Anda buat untuk tindakan tersebut.
organization_id dengan ID organisasi Google Cloud Anda.
scan_file_ref dengan jalur ke file rencana Terraform Anda, dalam format JSON.
failure_criteria dengan kriteria batas kegagalan
yang menentukan kapan tindakan gagal. Kriteria nilai minimum didasarkan pada jumlah masalah dengan tingkat keparahan kritis, tinggi, sedang, dan rendah yang ditemukan oleh pemindaian validasi IaC. failure_criteria menentukan jumlah
masalah dengan setiap tingkat keparahan yang diizinkan dan cara masalah diagregasi
(baik AND maupun OR). Misalnya, jika Anda ingin tindakan gagal jika menemukan satu masalah kritis atau satu masalah dengan tingkat keparahan tinggi, tetapkan
failure_criteria ke Critical:1,High:1,Operator:OR. Defaultnya adalah
Critical:1,High:1,Medium:1,Low:1,Operator:OR, yang berarti bahwa jika pemindaian validasi IaC
menemukan masalah, tindakan harus gagal.
Sekarang Anda dapat menjalankan alur kerja untuk memvalidasi file rencana Terraform. Untuk menjalankan
alur kerja secara manual, lihat Menjalankan alur kerja
secara manual.
Melihat laporan pelanggaran IaC
Di repositori GitHub Anda, klik Actions, lalu pilih alur kerja Anda.
Klik eksekusi terbaru untuk alur kerja Anda.
Di bagian Artefak, laporan pelanggaran (ias-scan-sarif.json) tersedia dalam file zip. Laporan ini mencakup kolom berikut:
Kolom rules yang menjelaskan kebijakan mana yang dilanggar oleh
rencana Terraform. Setiap aturan menyertakan ruleID yang dapat Anda cocokkan dengan
hasil yang disertakan dalam laporan.
Kolom results yang menjelaskan usulan modifikasi aset yang
melanggar aturan tertentu.
Selesaikan pelanggaran apa pun dalam kode Terraform Anda sebelum menerapkannya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Integrate IaC validation with GitHub Actions\n\n| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nYou can use the [Analyze Code Security\naction](https://github.com/marketplace/actions/analyze-code-security) to\nvalidate the infrastructure as code (IaC) that is part of your GitHub Actions\nworkflow. Validating IaC lets you determine whether your Terraform resource\ndefinitions violate the existing organization policies and\nSecurity Health Analytics detectors that are applied to your Google Cloud resources.\n\nFor more information about IaC validation, see\n[Validate your IaC against your Google Cloud organization's policies](/security-command-center/docs/validate-iac).\n\nBefore you begin\n----------------\n\nComplete these tasks to get started with IaC validation with GitHub Actions.\n\n### Activate the Security Command Center Premium tier or Enterprise tier\n\nVerify that the\n[Security Command Center Premium tier or Enterprise tier](/security-command-center/docs/activate-scc-overview)\nis activated at the organization level.\n\nActivating Security Command Center enables the `securityposture.googleapis.com` and\n`securitycentermanagement.googleapis.com` APIs.\n\n### Create a service account\n\nCreate a service account that you can use for the Analyze Code Security\naction.\n\n1.\n In the Google Cloud console, go to the **Create service account** page.\n\n [Go to Create service account](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create?supportedpurview=project)\n2. Select your project.\n3.\n In the **Service account name** field, enter a name. The Google Cloud console fills\n in the **Service account ID** field based on this name.\n\n\n In the **Service account description** field, enter a description. For example,\n `Service account for quickstart`.\n4. Click **Create and continue**.\n5.\n Grant the **Security Posture Shift-Left Validator** role to the service account.\n\n\n To grant the role, find the **Select a role** list, then select\n **Security Posture Shift-Left Validator**.\n | **Note** : The **Role** field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.\n6. Click **Continue**.\n7.\n Click **Done** to finish creating the service account.\n\n\u003cbr /\u003e\n\nFor more information about IaC validation permissions, see\n[IAM for organization-level activations](/security-command-center/docs/access-control-org).\n\n### Set up authentication\n\n1. Configure Workload Identity Federation with your GitHub identity provider. For\n instructions, see\n [Workload Identity Federation](/iam/docs/workload-identity-federation).\n\n2. Obtain the URL for your Workload Identity Federation ID token. For example,\n `https://iam.googleapis.com/projects/`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`/locations/global/workloadIdentityPools/`\u003cvar translate=\"no\"\u003ePOOL_ID\u003c/var\u003e`/providers/`\u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e.\n\n Consider the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is the project number for the Google Cloud project that you set up Workload Identity Federation in.\n - \u003cvar translate=\"no\"\u003ePOOL_ID\u003c/var\u003e is the pool name.\n - \u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e is the name of your identity provider.\n3. Add the [Authenticate to Google Cloud\n action](https://github.com/marketplace/actions/authenticate-to-google-cloud)\n to your workflow to authenticate the IaC validation action.\n\n### Define your policies\n\nDefine your\n[organization policies](/resource-manager/docs/organization-policy/creating-managing-policies)\nand\n[Security Health Analytics detectors](/security-command-center/docs/concepts-security-health-analytics).\nTo define these policies using a security posture, complete the tasks in\n[Create and deploy a posture](/security-command-center/docs/how-to-use-security-posture#create_and_deploy_a_posture).\n\nCreate your Terraform plan JSON file\n------------------------------------\n\n1. Create your Terraform code. For instructions, see [Create your Terraform\n code](/security-command-center/docs/validate-iac#create_your_terraform_code).\n\n2. In your GitHub Actions, initialize Terraform. For example, if you're using\n the [HashiCorp - Setup Terraform action](https://github.com/marketplace/actions/hashicorp-setup-terraform), run the following command:\n\n - name: Terraform Init\n id: init\n run: terraform init\n\n3. Create a Terraform plan file:\n\n - name: Create Terraform Plan\n id: plan\n run: terraform plan -out=\u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e with the name for the Terraform plan\n file. For example, `myplan.tfplan`.\n4. Convert your plan file into JSON format:\n\n - name: Convert Terraform Plan to JSON\n id: convert\n run: terraform show -no-color -json \u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e \u003e \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILE\u003c/var\u003e with the name for the Terraform\n plan file, in JSON format. For example, `mytfplan.json`.\n\nAdd the action to your GitHub Actions workflow\n----------------------------------------------\n\n1. In the GitHub repository, browse to your workflow.\n2. Open the workflow editor.\n3. In the GitHub Marketplace sidebar, search for **Analyze Code Security**.\n4. In the **Installation** section, copy the syntax.\n5. Paste the syntax as a new step into your workflow.\n6. Replace the following values:\n\n - `workload_identity_provider` with the link to the URL for your Workload Identity Federation ID token.\n - `service_account` with the email address of the service account that you created for the action.\n - `organization_id` with your Google Cloud organization ID.\n - `scan_file_ref` with the path to your Terraform plan file, in JSON format.\n - `failure_criteria` with the failure threshold criteria that determines when the action fails. The threshold criteria is based on the number of critical, high, medium, and low severity issues that the IaC validation scan encounters. `failure_criteria` specifies how many issues of each severity are permitted and how the issues are aggregated (either `AND` or `OR`). For example, if you want the action to fail if it encounters one critical issue *or* one high severity issue, set the `failure_criteria` to `Critical:1,High:1,Operator:OR`. The default is `Critical:1,High:1,Medium:1,Low:1,Operator:OR`, which means that if the IaC validation scan encounters any issue, the action must fail.\n\nYou can now run the workflow to validate your Terraform plan file. To run the\nworkflow manually, see [Manually running a\nworkflow](https://docs.github.com/en/actions/using-workflows/manually-running-a-workflow).\n\nView the IaC violation report\n-----------------------------\n\n1. In your GitHub repository, click **Actions** and select your workflow.\n\n2. Click the most recent run for your workflow.\n\n In the **Artifacts** section, the violation report (`ias-scan-sarif.json`) is available in a zip file. The report includes the\n following fields:\n - A `rules` field that describes which policies were violated by the Terraform plan. Each rule includes a `ruleID` that you can match with the results that are included in the report.\n - A `results` field that describes the proposed asset modifications that violate a specific rule.\n3. Resolve any violations within your Terraform code before applying it.\n\nWhat's next\n-----------\n\n- View the [analyze-code-security-scc action\n source code](https://github.com/google-github-actions/analyze-code-security-scc/) in GitHub."]]
