kics

kics documentation

Configuration in MegaLinter

Enable kics by adding REPOSITORY_KICS in ENABLE_LINTERS variable
Disable kics by adding REPOSITORY_KICS in DISABLE_LINTERS variable

Variable	Description	Default value
REPOSITORY_KICS_ARGUMENTS	User custom arguments to add in linter CLI call Ex: `-s --foo "bar"`
REPOSITORY_KICS_COMMAND_REMOVE_ARGUMENTS	User custom arguments to remove from command line before calling the linter Ex: `-s --foo "bar"`
REPOSITORY_KICS_CLI_LINT_MODE	Override default CLI lint mode ⚠️ As default value is project, overriding might not work - `file`: Calls the linter for each file - `list_of_files`: Call the linter with the list of files as argument - `project`: Call the linter from the root of the project	`project`
REPOSITORY_KICS_PRE_COMMANDS	List of bash commands to run before the linter	None
REPOSITORY_KICS_POST_COMMANDS	List of bash commands to run after the linter	None
REPOSITORY_KICS_UNSECURED_ENV_VARIABLES	List of env variables explicitly not filtered before calling REPOSITORY_KICS and its pre/post commands	None
REPOSITORY_KICS_CONFIG_FILE	kics configuration file nameUse `LINTER_DEFAULT` to let the linter find it	`kics.config`
REPOSITORY_KICS_RULES_PATH	Path where to find linter configuration file	Workspace folder, then MegaLinter default rules
REPOSITORY_KICS_DISABLE_ERRORS	Run linter but consider errors as warnings	`false`
REPOSITORY_KICS_DISABLE_ERRORS_IF_LESS_THAN	Maximum number of errors allowed	`0`
REPOSITORY_KICS_CLI_EXECUTABLE	Override CLI executable	`['kics']`

MegaLinter Flavors

This linter is available in the following flavors

Flavor	Description	Embedded linters
all	Default MegaLinter Flavor	124
cupcake	MegaLinter for the most commonly used languages	83
security	Optimized for security	24
terraform	Optimized for TERRAFORM based projects	54

Behind the scenes

How are identified applicable files

If this linter is active, all files will always be linted

How the linting is performed

kics is called once on the whole project directory (project CLI lint mode)

filtering can not be done using MegaLinter configuration variables,it must be done using kics configuration or ignore file (if existing)
VALIDATE_ALL_CODEBASE: false doesn't make kics analyze only updated files

Example calls

kics scan --path .

Help content

Keeping Infrastructure as Code Secure

Usage:
  kics [command]

Available Commands:
  analyze        Determines the detected platforms of a certain project
  generate-id    Generates uuid for query
  help           Help about any command
  list-platforms List supported platforms
  remediate      Auto remediates the project
  scan           Executes a scan analysis
  version        Displays the current version

Flags:
      --ci                  display only log messages to CLI output (mutually exclusive with silent)
  -h, --help                help for kics
  -f, --log-format string   determines log format (pretty,json) (default "pretty")
      --log-level string    determines log level (TRACE,DEBUG,INFO,WARN,ERROR,FATAL) (default "INFO")
      --log-path string     path to generate log file (info.log)
      --no-color            disable CLI color output
      --profiling string    enables performance profiler that prints resource consumption metrics in the logs during the execution (CPU, MEM)
  -s, --silent              silence stdout messages (mutually exclusive with verbose and ci)
  -v, --verbose             write logs to stdout too (mutually exclusive with silent)

Use "kics [command] --help" for more information about a command.

Installation on mega-linter Docker image

Dockerfile commands :

# renovate: datasource=docker depName=checkmarx/kics
ARG REPOSITORY_KICS_VERSION=v2.1.3-alpine
FROM checkmarx/kics:${REPOSITORY_KICS_VERSION} AS kics
COPY --link --from=kics /app/bin/kics /usr/bin/kics
ENV KICS_QUERIES_PATH=/usr/bin/assets/queries KICS_LIBRARIES_PATH=/usr/bin/assets/libraries
COPY --from=kics /app/bin/assets /usr/bin/assets