Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Anda dapat menggunakan plugin Google Analyze Code Security untuk
Jenkins guna memvalidasi
Infrastructure as Code (IaC) yang merupakan bagian dari project Jenkins Anda.
Memvalidasi IaC memungkinkan Anda menentukan apakah definisi resource Terraform Anda melanggar kebijakan organisasi dan detektor Security Health Analytics yang ada yang diterapkan ke resource Anda. Google Cloud
Di konsol Jenkins, di project freestyle Jenkins Anda, buka halaman
Configuration.
Klik Source Code Management.
Di Repository URL, masukkan URL ke kode Terraform yang Anda buat.
Klik Build steps.
Tambahkan langkah-langkah berikut:
Lakukan inisialisasi Terraform:
terraform init
Buat file rencana Terraform.
terraform plan -out=TF_PLAN_FILE
Ganti TF_PLAN_FILE dengan nama untuk file rencana Terraform. Contoh, myplan.tfplan.
Konversikan file rencana Anda ke dalam format JSON:
terraform show -no-color -json TF_PLAN_FILE > TF_PLAN_JSON_FILE
Ganti TF_PLAN_JSON_FILE dengan nama untuk file rencana Terraform, dalam format JSON. Contoh, mytfplan.json.
Menambahkan plug-in ke project Jenkins Anda
Di konsol Jenkins, di project freestyle Jenkins Anda, buka halaman
Configuration.
Di Build Steps, klik Add build step > Perform Code Scan during
Build.
Masukkan ID organisasi Anda.
Berikan jalur ke file rencana Terraform Anda, dalam format JSON.
Opsional: Tetapkan kriteria kegagalan build. Kriteria kegagalan didasarkan pada
jumlah masalah tingkat keseriusan kritis, tinggi, sedang, dan rendah yang ditemukan oleh pemindaian validasi IaC. Anda dapat menentukan jumlah masalah dengan setiap tingkat keparahan yang diizinkan dan cara masalah diagregasi (baik AND atau OR).
Klik Fail on Asset Violation.
Jika Anda ingin build gagal hanya jika jumlah masalah dari semua
tingkat keparahan tercapai, pilih AND. Jika Anda ingin build gagal
jika jumlah masalah dari tingkat keparahan apa pun tercapai, pilih OR.
Misalnya, jika Anda ingin build gagal jika menemukan satu masalah
kritis atau satu masalah dengan tingkat keparahan tinggi, tetapkan nilai gabungan ke OR.
Menunjukkan jumlah masalah pada berbagai tingkat keparahan yang ingin Anda izinkan sebelum build gagal.
Jika Anda tidak ingin menentukan kriteria kegagalan, pilih Abaikan Pelanggaran Aset.
Klik Simpan.
Sekarang Anda dapat menjalankan build untuk memvalidasi file rencana Terraform.
Melihat laporan pelanggaran IaC
Di konsol Jenkins, klik alur kerja terbaru untuk build Anda.
Klik Status. File HTML berikut tersedia sebagai artefak build:
Jika plugin berjalan, laporan pelanggaran (GoogleAnalyzeCodeSecurity_ViolationSummary.html)
Laporan mengelompokkan pelanggaran berdasarkan tingkat keseriusan. Bagian pelanggaran menjelaskan aturan yang tidak dipenuhi dan ID aset dari rencana Terraform yang melanggar aturan tersebut.
Jika build gagal, laporan ringkasan error
Selesaikan pelanggaran apa pun dalam kode Terraform Anda sebelum menerapkannya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[],[],null,["# Integrate IaC validation with Jenkins\n\n| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nYou can use the [Google Analyze Code Security plugin for\nJenkins](https://plugins.jenkins.io/google-analyze-code-security/) to validate\nthe infrastructure as code (IaC) that is part of your Jenkins project.\nValidating IaC lets you determine whether your Terraform resource definitions\nviolate the existing organization policies and\nSecurity Health Analytics detectors that are applied to your Google Cloud resources.\n\nFor more information about IaC validation, see\n[Validate your IaC against your Google Cloud organization's policies](/security-command-center/docs/validate-iac).\n\nIaC validation only works with [Jenkins freestyle\nprojects](https://www.jenkins.io/doc/book/using/working-with-projects/).\n\nBefore you begin\n----------------\n\nComplete these tasks to get started with IaC validation with Jenkins.\n\n### Activate the Security Command Center Premium tier or Enterprise tier\n\nVerify that the\n[Security Command Center Premium tier or Enterprise tier](/security-command-center/docs/activate-scc-overview)\nis activated at the organization level.\n\nActivating Security Command Center enables the `securityposture.googleapis.com` and\n`securitycentermanagement.googleapis.com` APIs.\n\n### Create a service account\n\nCreate a service account that you can use for the Google Analyze Code Security\nplugin for Jenkins.\n\n1.\n Create a service account:\n\n 1.\n In the Google Cloud console, go to the **Create service account** page.\n\n [Go to Create service account](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create?supportedpurview=project)\n 2. Select your project.\n 3.\n In the **Service account name** field, enter a name. The Google Cloud console fills\n in the **Service account ID** field based on this name.\n\n\n In the **Service account description** field, enter a description. For example,\n `Service account for quickstart`.\n 4. Click **Create and continue**.\n 5.\n Grant the **Security Posture Shift-Left Validator** role to the service account.\n\n\n To grant the role, find the **Select a role** list, then select\n **Security Posture Shift-Left Validator**.\n | **Note** : The **Role** field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.\n 6. Click **Continue**.\n 7.\n Click **Done** to finish creating the service account.\n\n\n Do not close your browser window. You will use it in the next step.\n2.\n Create a service account key:\n\n 1. In the Google Cloud console, click the email address for the service account that you created.\n 2. Click **Keys**.\n 3. Click **Add key** , and then click **Create new key**.\n 4. Click **Create**. A JSON key file is downloaded to your computer.\n 5. Click **Close**.\n\n\u003cbr /\u003e\n\nFor more information about IaC validation permissions, see\n[IAM for organization-level\nactivations](/security-command-center/docs/access-control-org).\n\n### Define your policies\n\nDefine your\n[organization policies](/resource-manager/docs/organization-policy/creating-managing-policies)\nand\n[Security Health Analytics detectors](/security-command-center/docs/concepts-security-health-analytics).\nTo define these policies using a security posture, complete the tasks in\n[Create and deploy a posture](/security-command-center/docs/how-to-use-security-posture#create_and_deploy_a_posture).\n\nInstall and configure the plug-in\n---------------------------------\n\n1. In the Jenkins console, click **Manage Jenkins** \\\u003e **Manage Plugins**.\n2. In the **Available** tab, search for **google-analyze-code-security**.\n3. Complete the installation steps.\n4. Click **Manage Jenkins** \\\u003e **Configure System**.\n5. In the **Google Analyze Code Security** section, click **Add credential**.\n6. In **Organization ID**, enter the organization ID for the Google Cloud organization that includes the Terraform resources that you want to create or modify.\n7. In **Security Command Center Credential**, add the service account key.\n8. Test the connection to verify the service account credentials.\n9. Click **Save**.\n\nCreate your Terraform plan JSON file\n------------------------------------\n\n1. Create your Terraform code. For instructions, see\n [Create your Terraform code](/security-command-center/docs/validate-iac#create_your_terraform_code).\n\n2. Install the [Terraform plugin for Jenkins](https://plugins.jenkins.io/terraform/).\n\n3. In the Jenkins console, in your Jenkins freestyle project, go to the\n **Configuration** page.\n\n4. Click **Source Code Management**.\n\n5. In **Repository URL**, enter the URL to the Terraform code that you created.\n\n6. Click **Build steps**.\n\n7. Add the following steps:\n\n 1. Initialize Terraform:\n\n terraform init\n\n 2. Create a Terraform plan file.\n\n terraform plan -out=\u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e with the name for the Terraform plan\n file. For example, `myplan.tfplan`.\n 3. Convert your plan file into JSON format:\n\n terraform show -no-color -json \u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e \u003e \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILE\u003c/var\u003e with the name for the Terraform\n plan file, in JSON format. For example, `mytfplan.json`.\n\nAdd the plug-in to your Jenkins project\n---------------------------------------\n\n1. In the Jenkins console, in your Jenkins freestyle project, go to the **Configuration** page.\n2. In **Build Steps** , click **Add build step** \\\u003e **Perform Code Scan during\n Build**.\n3. Enter your organization ID.\n4. Provide the path to your Terraform plan file, in JSON format.\n5. Optional: Set the build failure criteria. The failure criteria is based on\n the number of critical, high, medium, and low severity issues that the IaC\n validation scan encounters. You can specify how many issues of each severity\n are permitted and how the issues are aggregated (either **AND** or\n **OR**).\n\n 1. Click **Fail on Asset Violation**.\n\n 2. If you want the build to fail only if the count of issues from all\n severity levels is reached, select **AND** . If you want the build to fail\n if the count of issues from any severity level is reached, select **OR** .\n For example, if you want the build to fail if it encounters one critical\n issue *or* one high severity issue, set the aggregate value to **OR**.\n\n 3. Indicate the number of issues at the various severity levels that you want\n to permit before the build fails.\n\n If you don't want to specify a failure criteria, select **Ignore Asset\n Violation**.\n6. Click **Save**.\n\nYou can now run the build to validate your Terraform plan file.\n\nView the IaC violation report\n-----------------------------\n\n1. In the Jenkins console, click the most recent workflow for your build.\n\n2. Click **Status**. The following HTML files are available as build artifacts:\n\n - If the plug-in ran, the violation report (`GoogleAnalyzeCodeSecurity_ViolationSummary.html`)\n\n The report groups violations by severity. The violation section describes\n which rule wasn't met and the asset ID from the Terraform plan that violated\n the rule.\n - If the build failed, an error summary report\n3. Resolve any violations within your Terraform code before applying it.\n\nWhat's next\n-----------\n\n- View the [Google Analyze Code Security plugin](https://plugins.jenkins.io/google-analyze-code-security/)."]]
