Integrate Shift Left Inline APIs with Bitbucket and AWS CI/CD Services

Prerequisites

Before integration, make sure you have met the following prerequisite:

• Create a Bitbucket repository using the link Create a repository in Bitbucket.

Configure Bitbucket Pipelines

Perform the following steps to set up Bitbucket pipelines integration with Shift Left inline APIs.

1. Create a file named bitbucket-pipelines.yml in the repo's root directory and add the following content.

   • To evaluate only the changed files use the following script:

# This is a sample build configuration for Docker.
# Check our guides at https://confluence.atlassian.com/x/O1toN for more examples.
# Only use spaces to indent your .yml configuration.
# -----
# You can specify a custom docker image from Docker Hub as your build environment.
image: atlassian/default-image:2
 
pipelines:
  default:
    - step:
        name: "Shift Left Integration with Bitbucket"
        script:
            - git log HEAD -1 --name-only --pretty="format:" > changes.txt
            - cat changes.txt | { egrep -i '.json|.tf|.yml|.yaml' || true; } > changes_latest.txt
            - if test "$( wc -l < changes_latest.txt )" -gt 0; then
            - data=$(cat changes_latest.txt | while read line; do echo $line; done)
            - data=$(echo $data  | tr ' ' ',')
            - pipe: mcafeemvision/shift-left-atlassian-pipe:1.1.0
            variables:
                MVISION_USERNAME: $MVISION_USERNAME
                MVISION_PASSWORD: $MVISION_PASSWORD
                MVISION_ENVIRONMENT: $MVISION_ENVIRONMENT
                CLOUD_SERVICE_PROVIDER: $CLOUD_SERVICE_PROVIDER
                FILES: $data
                WORKSPACE: $BITBUCKET_WORKSPACE
                SLUG: $BITBUCKET_REPO_SLUG
                COMMIT_ID: $BITBUCKET_COMMIT
            - fi

• To evaluate all files every time a build is triggered, use this script:

# This is a sample build configuration for Docker.
# Check our guides at https://confluence.atlassian.com/x/O1toN for more examples.
# Only use spaces to indent your .yml configuration.
# -----
# You can specify a custom docker image from Docker Hub as your build environment.
image: atlassian/default-image:2
 
pipelines:
  default:
    - step:
        name: "Shift Left Integration with Bitbucket"
        script:
            - find ./ -type f \( -iname \*.yaml -o -iname \*.yml -o -iname \*.tf -o -iname \*.json\) > changes.txt
            - if test "$( wc -l < changes.txt )" -gt 0; then
            - data=$(cat changes.txt | while read line; do echo $line; done)
            - data=$(echo $data  | tr ' ' ',')
            - pipe: mcafeemvision/shift-left-atlassian-pipe:1.1.0
            variables:
                MVISION_USERNAME: $MVISION_USERNAME
                MVISION_PASSWORD: $MVISION_PASSWORD
                MVISION_ENVIRONMENT: $MVISION_ENVIRONMENT
                CLOUD_SERVICE_PROVIDER: $CLOUD_SERVICE_PROVIDER
                FILES: $data
                WORKSPACE: $BITBUCKET_WORKSPACE
                SLUG: $BITBUCKET_REPO_SLUG
                COMMIT_ID: $BITBUCKET_COMMIT
            - fi

2. Commit and push the bitbucket-pipelines.yml file.
3. Go to Settings > Repository variables. You are redirected to the Repository variables page.
   
4. Add the following variables and values in the repository variable page:
   • Add Name as CLOUD_SERVICE_PROVIDER and Value as aws (to evaluate AWS DevOps templates) or azure (to evaluate Azure resource manager templates).
   • Add Name as MVISION_USERNAME and Value as the username of Skyhigh CASB and select the secured checkbox.
   • Add Name as MVISION_PASSWORD and Value as the password of Skyhigh CASB and select the secured checkbox.
   • Add Name as MVISION_ENVIRONMENT and Value as the environment URL (https://www.myshn.net) of Skyhigh CASB.
5. Enable pipelines.

The Bitbucket pipeline integration with Skyhigh CASB Shift Left inline API is complete.

Any push to the Bitbucket repo triggers a build in pipelines, which calls the Shift Left inline APIs to check for vulnerabilities present in the DevOps template committed in Bitbucket.