Legacy Jenkins integration

Managing FortiCNAPP API credentials with Jenkins

There are a variety of ways to manage credentials in Jenkins. For more information, go to the Jenkins Documentation.

Collecting LW_API_KEY and LW_API_SECRET

To integrate with Jenkins, you must first collect your LW_API_KEY and LW_API_SECRET.

To view this information:

1. Log in to the FortiCNAPP console.
2. Click Settings > API keys.
3. Select or create an API key.
4. Click the download icon.
5. Open the downloaded .json file to view your API Key and Secret.

Adding LW_API_KEY and LW_API_SECRET as credentials

The following set of instructions add and configure global credentials in your Jenkins environment. Before implementing these credentials, check with your Jenkins administrator to verify that this is your organization's method of configuration.

Creating new credentials

To add new credentials:

1. Log in to Jenkins.
2. Go to Manage Jenkins.
3. Click Manage Credentials
4. Click Jenkins under Stores scoped to Jenkins.
5. Click Global credentials (unrestricted) under System.
6. Click Add credentials. Note: this may appear as add some credentials.

Then, add LW_API_KEY and LW_API_SECRET as “Secret text” credentials. For each credential:

1. In the Kind dropdown Secret text.
2. In the Scope dropdown, select Global.
3. Paste your secret in the Secret field.
4. In the ID field, enter LW_API_KEY or LW_API_SECRET.
5. Describe the credential.
6. Click Create.

Adding the credentials to your job configuration

Once you have added LW_API_KEY and LW_API_SECRET as secret text credentials, you must add them to your job configuration.

To add the credentials:

1. Open your Jenkins job configuration.
2. Go to the Build environment section.
3. Select Use secret text(s) or file(s).
4. Under Bindings, click Add.

For each credential,

1. In the Variable field, enter the Variable name (for example, LW_API_KEY).
2. In the Credentials dropdown, select the credential that corresponds with the named variable.
3. Click Save.

Using the lacework/codesec-iac image for IaC scanning

Preparing an env.list file

The lacework/codesec-iac image runs in Docker, but it relies on a number of environment variables being passed to it by Jenkins. This can be achieved by creating an env.list file in the workspace with the required variables and then having Docker use that for its environment.

The following script can be used:

#!/bin/bash
## Provide Lacework credentials
echo "LW_ACCOUNT=AcmeCorporation" > env.list
echo "LW_API_KEY=${LW_API_KEY}" >> env.list
echo "LW_API_SECRET=${LW_API_SECRET}" >> env.list
echo "SCAN_COMMAND=tf-scan" >> env.list
echo "WORKSPACE=src" >> env.list
## Provide Jenkins build details
env | grep '^BRANCH_\|^CHANGE_\|^TAG_\|^BUILD_\|^JOB_\|^JENKINS_\|^GIT_' >> env.list

Invoking Docker

Your can then invoke Docker in your Jenkins job with usage such as:

docker run --env-file env.list -v "$(pwd):/app/src" lacework/codesec-iac:stable

Defining an unstable result

To have your job reach an “unstable” result, you can add an entry for EXIT_FLAG that defines your threshold for IaC violations in the env.list file.

For example, to make a count of 2 violations of at least High severity be flagged as a problem, set the variable as:

echo "EXIT_FLAG=High=2" >> env.list

Then in your job configuration, define an exit code of 2 to indicate instability.

Available commands

For available commands, refer to Integrate with a CI/CD pipeline.