Jenkins용 Google Analyze Code Security 플러그인을 사용하여 Jenkins 프로젝트의 일부인 코드형 인프라(IaC)를 검증할 수 있습니다.
IaC 검증을 통해 Terraform 리소스 정의가 Google Cloud 리소스에 적용된 기존 조직 정책 및 Security Health Analytics 감지기를 위반하는지 여부를 확인할 수 있습니다.
TF_PLAN_FILE을 Terraform 계획 파일의 이름으로 바꿉니다. 예를 들면 myplan.tfplan입니다.
계획 파일을 JSON 형식으로 변환합니다.
terraform show -no-color -json TF_PLAN_FILE > TF_PLAN_JSON_FILE
TF_PLAN_JSON_FILE을 JSON 형식의 Terraform 계획 파일 이름으로 바꿉니다. 예를 들면 mytfplan.json입니다.
Jenkins 프로젝트에 플러그인 추가
Jenkins 콘솔의 Jenkins 자유형 프로젝트에서 구성 페이지로 이동합니다.
빌드 단계에서 빌드 단계 추가 > 빌드 중에 코드 스캔 수행을 클릭합니다.
조직 ID를 입력합니다.
Terraform 계획 파일의 경로를 JSON 형식으로 제공합니다.
선택사항: 빌드 실패 기준을 설정합니다. 실패 기준은 IaC 검증 스캔에서 발생하는 매우 심각한 문제, 심각도가 높은 문제, 심각도가 중간인 문제, 심각도가 낮은 문제 수를 기반으로 합니다. 허용되는 각 심각도의 문제 수를 지정하고 문제가 합산되는 방식(AND 또는 OR)도 지정할 수 있습니다.
애셋 위반 시 실패를 클릭합니다.
모든 심각도 수준의 문제 수에 도달한 경우에만 빌드가 실패하도록 하려면 AND를 선택합니다. 심각도 수준의 문제 수에 도달한 경우 빌드가 실패하도록 하려면 OR을 선택합니다. 예를 들어 중대한 문제 하나 또는 심각도가 높은 문제 하나가 발생하는 경우 빌드가 실패하도록 하려면 집계 값을 OR로 설정합니다.
빌드가 실패하기 전에 허용할 다양한 심각도 수준의 문제 수를 나타냅니다.
실패 기준을 지정하지 않으려면 애셋 위반 무시를 선택합니다.
저장을 클릭합니다.
이제 빌드를 실행하여 Terraform 계획 파일을 검증할 수 있습니다.
IaC 위반 보고서 보기
Jenkins 콘솔에서 빌드의 최신 워크플로를 클릭합니다.
상태를 클릭합니다. 다음 HTML 파일은 빌드 아티팩트로 사용할 수 있습니다.
플러그인이 실행된 경우 위반 보고서(GoogleAnalyzeCodeSecurity_ViolationSummary.html)
이 보고서는 심각도를 기준으로 위반사항을 그룹화합니다. 위반 섹션에서는 충족되지 않은 규칙과 규칙을 위반한 Terraform 계획의 애셋 ID를 설명합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nYou can use the [Google Analyze Code Security plugin for\nJenkins](https://plugins.jenkins.io/google-analyze-code-security/) to validate\nthe infrastructure as code (IaC) that is part of your Jenkins project.\nValidating IaC lets you determine whether your Terraform resource definitions\nviolate the existing organization policies and\nSecurity Health Analytics detectors that are applied to your Google Cloud resources.\n\nFor more information about IaC validation, see\n[Validate your IaC against your Google Cloud organization's policies](/security-command-center/docs/validate-iac).\n\nIaC validation only works with [Jenkins freestyle\nprojects](https://www.jenkins.io/doc/book/using/working-with-projects/).\n\nBefore you begin\n\nComplete these tasks to get started with IaC validation with Jenkins.\n\nActivate the Security Command Center Premium tier or Enterprise tier\n\nVerify that the\n[Security Command Center Premium tier or Enterprise tier](/security-command-center/docs/activate-scc-overview)\nis activated at the organization level.\n\nActivating Security Command Center enables the `securityposture.googleapis.com` and\n`securitycentermanagement.googleapis.com` APIs.\n\nCreate a service account\n\nCreate a service account that you can use for the Google Analyze Code Security\nplugin for Jenkins.\n\n1.\n Create a service account:\n\n 1.\n In the Google Cloud console, go to the **Create service account** page.\n\n [Go to Create service account](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create?supportedpurview=project)\n 2. Select your project.\n 3.\n In the **Service account name** field, enter a name. The Google Cloud console fills\n in the **Service account ID** field based on this name.\n\n\n In the **Service account description** field, enter a description. For example,\n `Service account for quickstart`.\n 4. Click **Create and continue**.\n 5.\n Grant the **Security Posture Shift-Left Validator** role to the service account.\n\n\n To grant the role, find the **Select a role** list, then select\n **Security Posture Shift-Left Validator**.\n | **Note** : The **Role** field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.\n 6. Click **Continue**.\n 7.\n Click **Done** to finish creating the service account.\n\n\n Do not close your browser window. You will use it in the next step.\n2.\n Create a service account key:\n\n 1. In the Google Cloud console, click the email address for the service account that you created.\n 2. Click **Keys**.\n 3. Click **Add key** , and then click **Create new key**.\n 4. Click **Create**. A JSON key file is downloaded to your computer.\n 5. Click **Close**.\n\n\u003cbr /\u003e\n\nFor more information about IaC validation permissions, see\n[IAM for organization-level\nactivations](/security-command-center/docs/access-control-org).\n\nDefine your policies\n\nDefine your\n[organization policies](/resource-manager/docs/organization-policy/creating-managing-policies)\nand\n[Security Health Analytics detectors](/security-command-center/docs/concepts-security-health-analytics).\nTo define these policies using a security posture, complete the tasks in\n[Create and deploy a posture](/security-command-center/docs/how-to-use-security-posture#create_and_deploy_a_posture).\n\nInstall and configure the plug-in\n\n1. In the Jenkins console, click **Manage Jenkins** \\\u003e **Manage Plugins**.\n2. In the **Available** tab, search for **google-analyze-code-security**.\n3. Complete the installation steps.\n4. Click **Manage Jenkins** \\\u003e **Configure System**.\n5. In the **Google Analyze Code Security** section, click **Add credential**.\n6. In **Organization ID**, enter the organization ID for the Google Cloud organization that includes the Terraform resources that you want to create or modify.\n7. In **Security Command Center Credential**, add the service account key.\n8. Test the connection to verify the service account credentials.\n9. Click **Save**.\n\nCreate your Terraform plan JSON file\n\n1. Create your Terraform code. For instructions, see\n [Create your Terraform code](/security-command-center/docs/validate-iac#create_your_terraform_code).\n\n2. Install the [Terraform plugin for Jenkins](https://plugins.jenkins.io/terraform/).\n\n3. In the Jenkins console, in your Jenkins freestyle project, go to the\n **Configuration** page.\n\n4. Click **Source Code Management**.\n\n5. In **Repository URL**, enter the URL to the Terraform code that you created.\n\n6. Click **Build steps**.\n\n7. Add the following steps:\n\n 1. Initialize Terraform:\n\n terraform init\n\n 2. Create a Terraform plan file.\n\n terraform plan -out=\u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e with the name for the Terraform plan\n file. For example, `myplan.tfplan`.\n 3. Convert your plan file into JSON format:\n\n terraform show -no-color -json \u003cvar translate=\"no\"\u003eTF_PLAN_FILE\u003c/var\u003e \u003e \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILE\u003c/var\u003e with the name for the Terraform\n plan file, in JSON format. For example, `mytfplan.json`.\n\nAdd the plug-in to your Jenkins project\n\n1. In the Jenkins console, in your Jenkins freestyle project, go to the **Configuration** page.\n2. In **Build Steps** , click **Add build step** \\\u003e **Perform Code Scan during\n Build**.\n3. Enter your organization ID.\n4. Provide the path to your Terraform plan file, in JSON format.\n5. Optional: Set the build failure criteria. The failure criteria is based on\n the number of critical, high, medium, and low severity issues that the IaC\n validation scan encounters. You can specify how many issues of each severity\n are permitted and how the issues are aggregated (either **AND** or\n **OR**).\n\n 1. Click **Fail on Asset Violation**.\n\n 2. If you want the build to fail only if the count of issues from all\n severity levels is reached, select **AND** . If you want the build to fail\n if the count of issues from any severity level is reached, select **OR** .\n For example, if you want the build to fail if it encounters one critical\n issue *or* one high severity issue, set the aggregate value to **OR**.\n\n 3. Indicate the number of issues at the various severity levels that you want\n to permit before the build fails.\n\n If you don't want to specify a failure criteria, select **Ignore Asset\n Violation**.\n6. Click **Save**.\n\nYou can now run the build to validate your Terraform plan file.\n\nView the IaC violation report\n\n1. In the Jenkins console, click the most recent workflow for your build.\n\n2. Click **Status**. The following HTML files are available as build artifacts:\n\n - If the plug-in ran, the violation report (`GoogleAnalyzeCodeSecurity_ViolationSummary.html`)\n\n The report groups violations by severity. The violation section describes\n which rule wasn't met and the asset ID from the Terraform plan that violated\n the rule.\n - If the build failed, an error summary report\n3. Resolve any violations within your Terraform code before applying it.\n\nWhat's next\n\n- View the [Google Analyze Code Security plugin](https://plugins.jenkins.io/google-analyze-code-security/)."]]
