AWS CodeBuild

Configure Cortex CLI code scanning in AWS CodeBuild.

Choose the architecture used by your AWS CodeBuild environment.

ARM64

version: 0.2
env:
  variables:
    CORTEX_API_URL: <your_cortex_api_url>
    CORTEX_CLI_VERSION: "0.13.16"
  secrets-manager:
    CORTEX_API_KEY: "CORTEX_API_KEY"
    CORTEX_API_KEY_ID: "CORTEX_API_KEY_ID"
phases:
  install:
    commands:
      - apt-get update
      - apt-get install -y curl jq git
  pre_build:
    commands:
      - echo "Getting repo name"
      - export CODEBUILD_ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
      - export CODEBUILD_GIT_BRANCH="$(git symbolic-ref HEAD --short 2>/dev/null)"
      - |
        if [ "$CODEBUILD_GIT_BRANCH" = "" ] ; then
          export CODEBUILD_GIT_BRANCH="$(git rev-parse HEAD | xargs git name-rev | cut -d' ' -f2 | sed 's/remotes\/origin\///g')";
        fi
      - export CODEBUILD_PROJECT=${CODEBUILD_BUILD_ID%:$CODEBUILD_LOG_PATH}
      - echo "Downloading cortexcli"
      - |
        crtx_resp=$(curl "${CORTEX_API_URL}/public_api/v1/unified-cli/releases/download-link?os=linux&architecture=arm64" -H "x-xdr-auth-id: ${CORTEX_API_KEY_ID}" -H "Authorization: ${CORTEX_API_KEY}")
      - crtx_url=$(echo "$crtx_resp" | jq -r ".signed_url")
      - curl -o cortexcli "$crtx_url"
      - chmod +x cortexcli
      - ./cortexcli --version
  build:
    commands:
      - |
        ./cortexcli \
          --api-base-url "${CORTEX_API_URL}" \
          --api-key "${CORTEX_API_KEY}" \
          --api-key-id "${CORTEX_API_KEY_ID}" \
          code scan \
          --directory "$(pwd)" \
          --repo-id $CODEBUILD_ACCOUNT_ID/$CODEBUILD_PROJECT \
          --branch $CODEBUILD_GIT_BRANCH \
          --source AWS_CODE_BUILD \
          --create-repo-if-missing
artifacts:
  files:
    - '**/*'

AMD64

version: 0.2
env:
  variables:
    CORTEX_API_URL: <your_cortex_api_url>
    CORTEX_CLI_VERSION: "0.13.14"
  secrets-manager:
    CORTEX_API_KEY: "CORTEX_API_KEY"
    CORTEX_API_KEY_ID: "CORTEX_API_KEY_ID"
phases:
  install:
    commands:
      - apt-get update
      - apt-get install -y curl jq git
  pre_build:
    commands:
      - echo "Getting repo name"
      - export CODEBUILD_ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
      - export CODEBUILD_GIT_BRANCH="$(git symbolic-ref HEAD --short 2>/dev/null)"
      - |
        if [ "$CODEBUILD_GIT_BRANCH" = "" ] ; then
          export CODEBUILD_GIT_BRANCH="$(git rev-parse HEAD | xargs git name-rev | cut -d' ' -f2 | sed 's/remotes\/origin\///g')";
        fi
      - export CODEBUILD_PROJECT=${CODEBUILD_BUILD_ID%:$CODEBUILD_LOG_PATH}
      - echo "Downloading cortexcli"
      - |
        crtx_resp=$(curl "${CORTEX_API_URL}/public_api/v1/unified-cli/releases/download-link?os=linux&architecture=amd64" -H "x-xdr-auth-id: ${CORTEX_API_KEY_ID}" -H "Authorization: ${CORTEX_API_KEY}")
      - crtx_url=$(echo "$crtx_resp" | jq -r ".signed_url")
      - curl -o cortexcli "$crtx_url"
      - chmod +x cortexcli
      - ./cortexcli --version
  build:
    commands:
      - |
        ./cortexcli \
          --api-base-url "${CORTEX_API_URL}" \
          --api-key "${CORTEX_API_KEY}" \
          --api-key-id "${CORTEX_API_KEY_ID}" \
          code scan \
          --directory "$(pwd)" \
          --repo-id $CODEBUILD_ACCOUNT_ID/$CODEBUILD_PROJECT \
          --branch $CODEBUILD_GIT_BRANCH \
          --source AWS_CODE_BUILD \
          --create-repo-if-missing
artifacts:
  files:
    - '**/*'