Jenkins

Managing FortiCNAPP API credentials with Jenkins

There are a variety of ways to manage credentials in Jenkins. For more information, go to the Jenkins Documentation.

Collecting LW_API_KEY and LW_API_SECRET

To integrate with Jenkins, you must first collect your LW_API_KEY and LW_API_SECRET.

To collect the environment secrets:

1. Log in to the console.

2. Click Settings > API keys.

3. Select or create an API key.

4. Click the download icon.

5. Open the downloaded .json file to view your API Key and Secret.

Adding LW_API_KEY and LW_API_SECRET credentials

The following set of instructions add and configure global credentials in your Jenkins environment. Before implementing these credentials, check with your Jenkins administrator to verify that this is your organization's method of configuration.

Creating new credentials

To add new credentials:

1. Log in to Jenkins.

2. Go to Manage Jenkins.

3. Click Manage Credentials.

4. Click Jenkins under Stores scoped to Jenkins.

5. Click Global credentials (unrestricted) under System.

6. Click Add credentials.

   This may appear as add some credentials.

7. Add LW_API_KEY and LW_API_SECRET as Secret text credentials.

8. For each credential:

   1. In the Kind dropdown, click Secret text.

   2. In the Scope dropdown, select Global.

   3. Paste your secret in the Secret field.

   4. In the ID field, enter LW_API_KEY or LW_API_SECRET.

   5. Describe the credential.

   6. Click Create.

   

Adding the credentials to your job configuration

Once you have added LW_API_KEY and LW_API_SECRET as secret text credentials, you must add them to your job configuration.

To add the credentials to your job configuration:

1. Open your Jenkins job configuration.

2. Go to Build environment.

3. Select Use secret text(s) or file(s).

4. Under Bindings, click Add.

5. For each credential:

   1. In the Variable field, enter the Variable name (for example, LW_API_KEY).

   2. In the Credentials dropdown, select the credential that corresponds with the named variable.

   3. Click Save.

   

Using the lacework/codesec image for IaC scanning

Prepare an env.list File

The lacework/codesec-iac image runs in Docker, but it relies on a number of environment variables being passed to it by Jenkins. This can be achieved by creating an env.list file in the workspace with the required variables and then having Docker use that for its environment.

The following script can be used:

#!/bin/bash
## Provide Lacework credentials
echo "LW_ACCOUNT=AcmeCorporation" > env.list 
echo "LW_API_KEY=${LW_API_KEY}" >> env.list
echo "LW_API_SECRET=${LW_API_SECRET}" >> env.list 

## Provide Jenkins build details
env | grep '^BRANCH_\|^CHANGE_\|^TAG_\|^BUILD_\|^JOB_\|^JENKINS_\|^GIT_' >> env.list

Invoking Docker

Your can then invoke Docker in your Jenkins job with usage such as:

docker run --env-file env.list -v "$(pwd):/app/src" lacework/codesec:stable lacework iac scan --directory=.

Defining an unstable result

To have your job reach an “unstable” result, you can add an entry for EXIT_FLAG that defines your threshold for IaC violations in the env.list file.