Prepare for v0.35.0

[knqyf263]

Draft to collaborate on v0.35.0 release announcement

💿 AMI/EBS scanning 🏆

Trivy now scans AWS AMI images and EBS snapshots. You just need to specify your AMI ID with the ami: prefix.

$ trivy vm --security-checks vuln ami:ami-0123456789abcdefg
2022-11-24T21:06:23.516Z        INFO    Vulnerability scanning is enabled
2022-11-24T21:06:23.653Z        INFO    Snapshot snap-0123456789abcdefg found
2022-11-24T21:08:51.979Z        INFO    Detected OS: amazon
2022-11-24T21:08:51.979Z        INFO    Detecting Amazon Linux vulnerabilities...
2022-11-24T21:08:51.991Z        INFO    Number of language-specific files: 0

ami-0123456789abcdefg (amazon 2 (Karoo))
========================================
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 2, CRITICAL: 0)

Note: Public AMI images are not supported due to the limitation of AWS API. See the AWS document for the detail.

You can also directly scan EBS snapshots.

$ trivy vm --security-checks vuln ebs:snapshot-0123456789abcdefg
2022-11-24T21:06:23.516Z        INFO    Vulnerability scanning is enabled
2022-11-24T21:08:51.979Z        INFO    Detected OS: amazon
2022-11-24T21:08:51.979Z        INFO    Detecting Amazon Linux vulnerabilities...
2022-11-24T21:08:51.991Z        INFO    Number of language-specific files: 0

snapshot-0123456789abcdefg (amazon 2 (Karoo))
========================================
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 2, CRITICAL: 0)

Note: Public EBS snapshots are not supported due to the limitation of AWS API. See the AWS document for the detail.

⚠️ EXPERIMENTAL: AMI/EBS scanning is still experimental. This feature might change without preserving backward compatibility.

🐢 Slow scanning mode 🐜

--slow tries to use less CPU/memory for scanning though it takes more time than normal scanning. It fits small-footprint environments. The flag is unnecessary in most cases.

$ trivy image --slow alpine:3.15

🍡 Scan image digests in containerd 🍾

$ trivy image sha256:4dca0fd5f424a31b03ab807cbae77eb32bf2d089eed1cee154b3afed458de0dc

Thanks to @pmengelbert

🧾 Custom compliance reports ☑️

User can now use Trivy to scan your Kubernetes cluster with custom compliance report define by the user.
spec format should look like this:

---
spec:
  id: "0001" # report unique identifier
  title: nsa # report title 
  description: National Security Agency - Kubernetes Hardening Guidance # description of the report
  relatedResources :
    - https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/ # reference is related to public or internal spec
  version: "1.0" # spec version
  controls:
    - name: Non-root containers # short control naming
      description: 'Check that container is not running as root' # long control description
      id: '1.0' # control identifier 
      checks:   # list of trivy checks which associated to control
        - id: AVD-KSV-0012 # check ID (midconfiguration ot vulnerability) must start with `AVD-` or `CVE-` 
      severity: 'MEDIUM' # control severity
    - name: Immutable container file systems
      description: 'Check that container root file system is immutable'
      id: '1.1'
      checks:
        - id: AVD-KSV-0014
      severity: 'LOW'

In order to create it use the --compliance=@/spec/my_complaince.yaml flag.

Example:

$ trivy k8s cluster --compliance=@/spec/my_complaince.yaml --report summary

For more details here: compliance reports