CloudBees action: Scan Amazon S3 buckets with TruffleHog

Use this action to scan Amazon Simple Storage Service (S3) buckets with TruffleHog, an open-source secret scanning tool to detect secrets and sensitive information.

Prerequisites

This action requires prior authentication to Amazon Web Services (AWS), so you must invoke the AWS authentication action before invoking the TruffleHog S3 scan action. For more information, refer to the AWS credentials configuration action.

Inputs

Table 1. Input details

Input name	Data type	Required	Description
bucket-name	string	Yes	Name of the S3 bucket.
threshold-very-high	Integer	No	The number threshold of very high severity vulnerabilities at which the build is broken.
only-verified	String	No	Enables the verified flag to scan only verified secrets. The default is true.[1]

Important

[1] If only-verified is set to true, The TruffleHog tool may utilize an external third-party API to verify the secrets detected. Customers concerned about security implications involving third-party API calls should set the only-verified value to false, which returns all the secrets without verification and might include false positives. Refer to the TruffleHog credential verification documentation for more information.

Usage examples

In your YAML file, add:

      - name: Configure AWS credentials
        uses: cloudbees-io/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-2

      - name: Run TruffleHog S3 scan
        uses: cloudbees-io/trufflehog-secret-scan-s3@v1
        with:
          bucket-name: "test-bucket"

In the following example, if there are more than three very high severity vulnerabilities identified, the build is broken.

      - name: Run TruffleHog S3 scan with threshold
        uses: cloudbees-io/trufflehog-secret-scan-s3@v1
        with:
          bucket-name: "test-bucket"
          threshold-very-high: 3

In the following example, only-verified is set to false. The returned secrets are not verified and might include false positives.

      - name: Run TruffleHog S3 scan without verification
        uses: cloudbees-io/trufflehog-secret-scan-s3@v1
        with:
          bucket-name: "test-bucket"
          threshold-very-high: 3
          only-verified: false

License

This code is made available under the MIT license.

References

• Learn more about using actions in CloudBees workflows.

• Learn about the CloudBees platform.