diff --git a/README.md b/README.md index 136f9dc..9a697f9 100644 --- a/README.md +++ b/README.md @@ -186,6 +186,7 @@ jobs: DSSC_SMARTCHECK_HOST: ${{ secrets.DSSC_SMARTCHECK_HOST }} DSSC_SMARTCHECK_USER: ${{ secrets.DSSC_SMARTCHECK_USER }} DSSC_SMARTCHECK_PASSWORD: ${{ secrets.DSSC_SMARTCHECK_PASSWORD }} + # You will need to generate an access key and secret for your AWS user DSSC_IMAGE_PULL_AUTH: '{"aws":{"region":"us-east-1","accessKeyID":"$AWS_ACCESS_KEY_ID","secretAccessKey":"$AWS_SECRET_ACCESS_KEY"}}' DSSC_FINDINGS_THRESHOLD: '{"malware": 100, "vulnerabilities": { "defcon1": 100, "critical": 100, "high": 100 }, "contents": { "defcon1": 100, "critical": 100, "high": 100 }, "checklists": { "defcon1": 100, "critical": 100, "high": 100 }}' DSSC_INSECURE_SKIP_TLS_VERIFY: true @@ -210,12 +211,18 @@ jobs: DSSC_SMARTCHECK_HOST: ${{ secrets.DSSC_SMARTCHECK_HOST }} DSSC_SMARTCHECK_USER: ${{ secrets.DSSC_SMARTCHECK_USER }} DSSC_SMARTCHECK_PASSWORD: ${{ secrets.DSSC_SMARTCHECK_PASSWORD }} - DSSC_IMAGE_PULL_AUTH: '{"username": "oauth2accesstoken", "password": "${{ secrets.GCP_TOKEN }}"}' + # You will need to generate a JSON service account key in GCP and save it as a secret + DSSC_IMAGE_PULL_AUTH: '{"username": "_json_token", "password": "${{ secrets.GCP_JSON_KEY }}"}' DSSC_FINDINGS_THRESHOLD: '{"malware": 100, "vulnerabilities": { "defcon1": 100, "critical": 100, "high": 100 }, "contents": { "defcon1": 100, "critical": 100, "high": 100 }, "checklists": { "defcon1": 100, "critical": 100, "high": 100 }}' DSSC_INSECURE_SKIP_TLS_VERIFY: true DSSC_INSECURE_SKIP_REGISTRY_TLS_VERIFY: true ``` +The example above demonstrates how to add a Smartcheck Scan action as a step in your Github Worflow. This can be used to scan an image from a container registry in either Google Container Registry, Microsoft Azure Container Registry or Amazon Elastic Container Registry. -**PS.: For GCP users, you'll need to setup your authentication using an Access token and assigning the right permissions, more details here: https://cloud.google.com/container-registry/docs/advanced-authentication#token** +For Google Container Registry and Microsoft Azure Container Registry, the `username` and `password` required for `DSSC_IMAGE_PULL_AUTH` are the same as the docker login credentials you would use to authenticate to a registry in the provided platform: +- [Google Cloud Platform](https://cloud.google.com/container-registry/docs/advanced-authentication#json-key) +- [Microsoft Azure Web Services](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication) + +To authenticate to an Amazon Elastic Container Registry the `DSSC_IMAGE_PULL_AUTH` should be formatted to match the `credentials.aws` object specified in the [Smartcheck API Documentation to create a Scan](https://deep-security.github.io/smartcheck-docs/api/index.html#operation/createScan). ## Example Workflow Running a Docker Container