|
| 1 | +# Ansible Provider |
| 2 | + |
| 3 | +he Ansible provider enables security and compliance verification of Ansible playbooks using cnquery. |
| 4 | + |
| 5 | +## Get started |
| 6 | + |
| 7 | +```shell |
| 8 | +±> cnquery shell ansible providers/ansible/play/testdata/play_cert_validation.yaml |
| 9 | +→ connected to Ansible Playbook |
| 10 | + ___ _ __ __ _ _ _ ___ _ __ _ _ |
| 11 | + / __| '_ \ / _` | | | |/ _ \ '__| | | | |
| 12 | +| (__| | | | (_| | |_| | __/ | | |_| | |
| 13 | + \___|_| |_|\__, |\__,_|\___|_| \__, | |
| 14 | + mondoo™ |_| |___/ interactive shell |
| 15 | + |
| 16 | +cnquery> ansible.plays |
| 17 | +ansible.plays: [ |
| 18 | + 0: ansible.play name="Install packages" |
| 19 | +] |
| 20 | +``` |
| 21 | +
|
| 22 | +## Common Queries |
| 23 | +
|
| 24 | +Query all plays in a playbook: |
| 25 | +
|
| 26 | +```javascript |
| 27 | +ansible.plays |
| 28 | +``` |
| 29 | +
|
| 30 | +Access specific play details: |
| 31 | +
|
| 32 | +```javascript |
| 33 | +ansible.plays.first.name |
| 34 | +``` |
| 35 | +
|
| 36 | +## Example |
| 37 | +
|
| 38 | +Assume the following ansible tasks where we install httpd |
| 39 | +with [yum](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/dnf_module.html#ansible-collections-ansible-builtin-dnf-module): |
| 40 | +
|
| 41 | +```yaml |
| 42 | +- name: Install packages |
| 43 | + hosts: all |
| 44 | + gather_facts: false |
| 45 | + tasks: |
| 46 | + - name: Install httpd server |
| 47 | + ansible.builtin.yum: |
| 48 | + name: httpd>=2.4 |
| 49 | + state: present |
| 50 | + validate_certs: false |
| 51 | +``` |
| 52 | +
|
| 53 | +You can easily query all tasks for all plays in the playbook: |
| 54 | +
|
| 55 | +```shell |
| 56 | +cnquery> ansible.plays.map(tasks) |
| 57 | +ansible.plays.map: [ |
| 58 | + 0: [ |
| 59 | + 0: { |
| 60 | + name: "Install httpd server" |
| 61 | + } |
| 62 | + ] |
| 63 | +] |
| 64 | +``` |
| 65 | +
|
| 66 | +You can also query for all tasks that use `ansible.builtin.yum`: |
| 67 | +
|
| 68 | +```shell |
| 69 | +cnquery> ansible.plays { tasks.where (action["ansible.builtin.yum"] != empty) } |
| 70 | +ansible.plays: [ |
| 71 | + 0: { |
| 72 | + tasks.where: [ |
| 73 | + 0: ansible.task name="Install httpd server" |
| 74 | + ] |
| 75 | + } |
| 76 | +] |
| 77 | +``` |
| 78 | +
|
| 79 | +To enforce that no `ansible.builtin.yum` is using `validate_certs: false`, you write the following MQL: |
| 80 | +
|
| 81 | +```shell |
| 82 | +ansible.plays.all( |
| 83 | + tasks.where(action["ansible.builtin.yum"] != empty).all( |
| 84 | + action["ansible.builtin.yum"]["validate_certs"] != false |
| 85 | + ) |
| 86 | +) |
| 87 | +``` |
| 88 | +
|
| 89 | +Query packs allow you to collect information from your Ansible playbooks without enforcing compliance. Create a query |
| 90 | +pack to identify tasks that disable certificate validation: |
| 91 | +
|
| 92 | +```yaml |
| 93 | +packs: |
| 94 | + - uid: ansible-example-pack |
| 95 | + name: Ansible Example Pack |
| 96 | + version: 1.0.0 |
| 97 | + license: BUSL-1.1 |
| 98 | + authors: |
| 99 | + - name: Mondoo, Inc |
| 100 | + email: hello@mondoo.com |
| 101 | + groups: |
| 102 | + - title: Query tasks that use insecure yum |
| 103 | + filters: asset.platform == 'ansible-playbook' |
| 104 | + queries: |
| 105 | + - uid: ansible-example-pack-yum-validate-certs |
| 106 | + title: Ansible tasks that do not validate yum certificates |
| 107 | + mql: | |
| 108 | + ansible.plays { |
| 109 | + tasks.where (action["ansible.builtin.yum"]["validate_certs"] == false ) |
| 110 | + } |
| 111 | +``` |
| 112 | +
|
| 113 | +Execute the query pack and format the output with `jq`: |
| 114 | +
|
| 115 | +```shell |
| 116 | +cnquery scan ansible providers/ansible/play/testdata/play_cert_validation.yaml -f providers/ansible/examples/querypack.mql.yaml --output json | jq . |
| 117 | +``` |
| 118 | +
|
| 119 | +Policies enforce security and compliance standards by defining checks that must pass. Create a policy to ensure |
| 120 | +`validate_certs` is always enabled for yum tasks: |
| 121 | +
|
| 122 | +```yaml |
| 123 | +policies: |
| 124 | + - uid: ansible-example-policy |
| 125 | + name: Ansible Example Policy |
| 126 | + version: 1.0.0 |
| 127 | + license: BUSL-1.1 |
| 128 | + require: |
| 129 | + - provider: ansible |
| 130 | + authors: |
| 131 | + - name: Mondoo, Inc |
| 132 | + email: hello@mondoo.com |
| 133 | + groups: |
| 134 | + - title: Insecure permissions |
| 135 | + filters: | |
| 136 | + asset.platform == 'ansible-playbook' |
| 137 | + checks: |
| 138 | + - uid: ansible-example-policy-yum-validate-cert |
| 139 | + title: Ensure `validate_certs` is enabled for `ansible.builtin.yum` |
| 140 | + mql: | |
| 141 | + ansible.plays.all( |
| 142 | + tasks.where(action["ansible.builtin.yum"] != empty).all( |
| 143 | + action["ansible.builtin.yum"]["validate_certs"] != false |
| 144 | + ) |
| 145 | + ) |
| 146 | +``` |
| 147 | +
|
| 148 | +Execute the policy scan: |
| 149 | +
|
| 150 | +```shell |
| 151 | +cnspec scan ansible providers/ansible/play/testdata/play_cert_validation.yaml -f providers/ansible/examples/policy.mql.yaml |
| 152 | +``` |
0 commit comments