Overview

Organizations using Aqua Supply Chain Security (SCS) often need to run Infrastructure-as-Code (IaC) misconfiguration scans in CI/CD pipelines without triggering Software Composition Analysis (SCA) or Static Application Security Testing (SAST). The standard CI integration documentation shows a combined scan command that includes vulnerability and secret scanners, but IaC-only scanning requires a narrower scanner configuration.

This article explains how to configure Trivy-based CI jobs in GitLab, Bamboo, or Jenkins to perform IaC-only scans and publish results to the Aqua SCS module.

Understanding Scanner Types in CI Integrations

Aqua Supply Chain Security CI integrations use Trivy as the scanning engine. Trivy supports multiple scanner types that can be enabled individually or in combination:

The default documentation example combines multiple scanners:

trivy fs --scanners misconfig,vuln,secret --sast .

To meet IaC-only requirements, limit the --scanners flag to misconfig.

IaC-Only Scan Command

Use the following command to scan only for IaC misconfigurations:

trivy fs --scanners misconfig .

This command:

• Scans the current directory and subdirectories for IaC files
• Detects misconfigurations in Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles, and other supported IaC formats
• Excludes vulnerability (SCA), secret, and SAST findings

Publishing Results to Aqua SCS

When the CI environment is configured with Aqua plugin variables, scan results are automatically published to the Supply Chain Security module:

export TRIVY_RUN_AS_PLUGIN="aqua"
export AQUA_KEY="<your-api-key>"
export AQUA_SECRET="<your-api-secret>"
export AQUA_URL="<your-aqua-console-url>"

trivy fs --scanners misconfig .

With these environment variables set in the CI job, results appear in the Aqua console under Supply Chain Security without additional upload steps.

Platform-Specific Integration

The IaC-only scan command works consistently across CI platforms. Add it as a pipeline step or job in your existing integration.

GitLab CI/CD

aqua_iac_scan:
  stage: security
  image: registry.aquasec.com/aqua-scanner:latest
  variables:
    TRIVY_RUN_AS_PLUGIN: "aqua"
    AQUA_KEY: $AQUA_KEY
    AQUA_SECRET: $AQUA_SECRET
    AQUA_URL: $AQUA_URL
  script:
    - trivy fs --scanners misconfig .

Bamboo

Add a script task to your Bamboo plan:

#!/bin/bash
export TRIVY_RUN_AS_PLUGIN="aqua"
export AQUA_KEY="${bamboo.aquaKey}"
export AQUA_SECRET="${bamboo.aquaSecret}"
export AQUA_URL="${bamboo.aquaUrl}"

trivy fs --scanners misconfig .

Jenkins

Add a shell step to your Jenkins pipeline:

stage('Aqua IaC Scan') {
    steps {
        sh '''
            export TRIVY_RUN_AS_PLUGIN="aqua"
            export AQUA_KEY="${AQUA_KEY}"
            export AQUA_SECRET="${AQUA_SECRET}"
            export AQUA_URL="${AQUA_URL}"
            trivy fs --scanners misconfig .
        '''
    }
}

Scanner Scope Reference

IaC-Only (This Article)

trivy fs --scanners misconfig .

Full Supply Chain Scan (Default Documentation)

trivy fs --scanners misconfig,vuln,secret --sast .

Vulnerability Scan Only (No IaC)

trivy fs --scanners vuln .

Verification and Monitoring

After configuring the IaC-only scan:

1. 1. Trigger a CI pipeline run against a repository containing IaC files (e.g., Terraform)
2. 2. Confirm the pipeline completes without SCA or SAST scan phases
3. 3. Navigate to Supply Chain Security in the Aqua console
4. 4. Verify misconfiguration findings appear for the scanned repository
5. 5. Confirm no vulnerability or secret findings are reported (unless present from prior scans)

Important Considerations

• Trivy is the scan engine: The trivy fs command is an open-source Trivy command. Aqua integration is achieved through the TRIVY_RUN_AS_PLUGIN="aqua" environment variable and API credentials, not through platform-specific Aqua CLI wrappers.
• Repository scope: The . argument scans the current working directory. Adjust the path if IaC files are in a subdirectory (e.g., trivy fs --scanners misconfig ./terraform).
• Combined scans: If requirements change, add scanners to the --scanners flag as comma-separated values without changing the CI platform integration.

Best Practices

• Use IaC-only scans in pipelines where SCA and SAST are handled by separate dedicated security stages
• Store Aqua API credentials as CI/CD secrets rather than hardcoding in pipeline files
• Pin the scanner image version in production pipelines for reproducible results
• Test with a sample Terraform or CloudFormation repository before rolling out to all pipelines

Platform Coverage

• Aqua Component: Supply Chain Security (SCS)
• Scan Engine: Trivy (via aqua-scanner image)
• CI Platforms: GitLab, Bamboo, Jenkins, and any platform supporting shell script execution
• Deployment: SaaS and Self-Hosted

Summary

Related Resources

• Aqua CI Integrations Documentation
• Trivy Misconfiguration Scanner
• Supply Chain Security Overview