Packer Plugin cnspec by Mondoo scans Linux and Windows HashiCorp Packer builds for vulnerabilities and security misconfigurations. The plugin retrieves CVE data from Mondoo that is updated daily with the latest CVEs and advisories. Additionally, cnspec runs security scans using cnspec-policies to uncover common misconfigurations that open your hosts to the risk of attack. cnspec supports scanning Linux, Windows, and macOS, as well as Docker containers.
Packer Plugin cnspec is designed to work in one of two modes:
-
Unregistered - In unregistered mode, the plugin works without being registered with Mondoo Platform, and is designed to provide baseline security scanning with minimal configuration. On Linux builds, the plugin runs the Linux Security by Mondoo policy. On Windows builds, the plugin runs the Windows Security by Mondoo policy. Each of these policies provides security hardening checks based on industry standards for Linux and Windows. Scan results display in STDOUT during the Packer run.
-
Registered - In registered mode, the plugin is registered with your account in Mondoo Platform using a service account. This allows you to configure and customize any of the policies in Mondoo Platform, including CIS benchmarks and more. Scan results are shown in STDOUT and sent back to Mondoo Platform for your records.
Check out the Packer tutorials on the Mondoo documentation site:
You can install Packer Plugin cnspec using the packer init command, install it manually, or build it from source.
As of version 1.7, Packer's packer init command allows automatic installation of Packer plugins. For more information, read the Packer documentation.
To install Packer Plugin cnspec:
- Copy and paste this code into your Packer configuration.
packer {
required_plugins {
cnspec = {
version = ">= 10.0.0"
source = "github.com/mondoohq/cnspec"
}
}
}- Run this command:
packer init /path/to/template.pkr.hclYou can find pre-built binary releases of the plugin here.
Once you have downloaded the latest archive corresponding to your target OS, uncompress it to retrieve the plugin binary file corresponding to your platform. To install the plugin, follow the Packer documentation on installing a plugin.
If you prefer to build the plugin from source:
-
Clone this GitHub repository locally.
-
Run this command from the root directory:
go build -
After you successfully compile, the
packer-plugin-cnspecplugin binary file is in the root directory. Copy the binary into~/.packer.d/plugins/by running this command:make dev -
To install the compiled plugin, follow the Packer documentation on installing plugins.
After building the cnspec plugin successfully, use the latest version of Packer to build a machine and verify your changes. In the example folder we provide a basic template. To force Packer to use the development binary installed in the previous step, comment out the packer {} block.
To use the developer plugin, set the packer plugin environment variable:
export PACKER_PLUGIN_PATH=~/.packer.d/plugins
packer build amazon-linux-2.pkr.hcl| Name | Description | Type | Default | Required |
|---|---|---|---|---|
annotations |
Apply custom annotations to Packer build assets to provide additional metadata for asset tracking. | map of strings |
None | No |
asset_name |
Overwrite the asset name in Mondoo Platform. | string |
None | No |
on_failure |
Set on_failure = "continue" to ignore build failures that do not meet any set score_threshold. |
string |
None | No |
score_threshold |
Set a score threshold for Packer builds [0-100]. Any scans that fall below the score_threshold will fail unless on_failure = "continue". To learn more, read How Mondoo scores policies in the Mondoo documentation. |
int |
None | No |
sudo |
Use sudo to elevate permissions when running Mondoo scans. | bool |
None | No |
mondoo_config_path |
The path to the Mondoo's service account. Defaults to $HOME/.config/mondoo/mondoo.yml |
string |
None | No |
output |
Set output format: compact, csv, full, json, junit, report, summary, yaml (default "compact") | string |
None | No |
output_target |
Set output target. E.g. path to local file result.xml |
string |
None | No |
A simple configuration where we set a score threshold of 85 and use sudo to elevate permissions when running the scans:
provisioner "cnspec" {
on_failure = "continue"
score_threshold = 85
sudo {
active = true
}
}The following configuration shows how to set the output format to JUnit and the output target to test-results.xml:
provisioner "cnspec" {
on_failure = "continue"
output = "junit"
output_target = "test-results.xml"
}You can find example Packer templates in the examples directory in this repository. You can also find a GitHub Action workflow example of how to use cnspec to test builds as part of a CI/CD pipeline.
cnspec's benefits extend well beyond securing Packer builds! To start exploring, download cnspec.
If you think you've found a bug in the code or you have a question about using this software, please reach out to us by opening an issue in this GitHub repository.
Contributions to this project are welcome! If you want to fix a bug, please do so by opening a pull request in this GitHub repository. If you want to add a feature, please start by opening an issue in this GitHub repository to discuss it with us beforehand.
Join the Mondoo Community GitHub Discussions to collaborate on policy as code and security automation.
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "github-actions[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent