CLI usage

To run FortiCNAPP's Infrastructure as Code (IaC) offerings with the FortiCNAPP CLI, you must install the Lacework CLI according to your operating system, use API keys to authenticate, and configure the CLI for FortiCNAPP and for IaC security.

Installing the FortiCNAPP CLI

Bash (macOS/Linux)

curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash

Powershell (Windows)

1. Open a PowerShell terminal and run the following command:

   Set-ExecutionPolicy Bypass -Scope Process -Force
   iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.ps1'))
   

   The FortiCNAPP CLI is installed at C:\ProgramData\Lacework\lacework.exe and the system PATH environment variable is updated to include the FortiCNAPP CLI.

2. Open a new PowerShell terminal to read the updated system PATH and use the FortiCNAPP CLI.

Homebrew (macOS/Linux)

brew install lacework/tap/lacework-cli

For more details, see the Lacework Homebrew Tap.

Chocolatey (Windows):

choco install lacework-cli

For more details, see the Lacework CLI Chocolatey package.

Creating an API key

The FortiCNAPP CLI requires an API key and secret to authenticate with FortiCNAPP. FortiCNAPP API Keys can be created by account administrators through the console. For more information, go to API Access Keys and Tokens.

To create a key:

1. Log in to the console.
2. Click Settings > API keys.
3. Click Add New.
4. Enter a name for the key and an optional description.
5. Click Save.
6. Click the ... icon and then Download to save the API key file locally.

The contents of your API key contain a keyId secret, subAccount, and account:

{
  "keyId": "ACCOUNT_ABCEF01234559B9B07114E834D8570F567C824039756E03",
  "secret": "_abc1234e243a645bcf173ef55b837c19",
  "subAccount": "myaccount",
  "account": "myaccount.lacework.net"
}

Configuring the CLI

Use the lacework configure command to configure the FortiCNAPP CLI with the API Key downloaded from the previous step.

lacework configure -j /path/to/key.json

Example output:

Account: example
Access Key ID: EXAMPLE_1234567890ABCDE1EXAMPLE1EXAMPLE123456789EXAMPLE
Secret Access Key: **********************************

You are all set!

The lacework configure command generates a file named .lacework.toml inside your home directory ($HOME/.lacework.toml) with a single profile named default.

Configuring the CLI for IaC

Once you have installed the FortiCNAPP CLI and set up authentication with lacework configure, you must configure the CLI for use with FortiCNAPP's Infrastructure as Code (IaC) Security.

To configure the FortiCNAPP CLI for IaC Security:

1. Run lacework component install iac in the FortiCNAPP CLI.
2. The FortiCNAPP CLI is now configured for IaC. You can now run lacework iac ....

Environment variables

Within the FortiCNAPP CLI:

• LW_ACCOUNT sets the account.
• LW_API_KEY sets the API key.
• LW_API_SECRET sets the API secret.

IaC CLI commands and usage

  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  scan        Scan infrastructure code files
  version     Display the version of the lacework IAC CLI

Usage

lacework iac [command]

A list of commands and command-line options is available by running lacework iac --help. Help and specific options for each command is available by running lacework iac [command] --help

Troubleshooting config for FortiCNAPP CLI

• To start over, try deleting (or backing up) your ~/.config/lacework/iac-config.json file.
• You should NOT have APIToken in your config when working with FortiCNAPP CLI.
• Run env and check for unintended Lacework-related values being set.