The Unexpected compliance with Vault and Trivy: Lessons Learned

package main

import (
    "context"
    "fmt"
    "log"
    "time"

    vault "github.com/hashicorp/vault/api"
    auth "github.com/hashicorp/vault/api/auth/approle"
)

// vaultTrivySetup initializes Vault's Transit secrets engine and creates
// short-lived Trivy scan credentials with 15-minute TTLs
func vaultTrivySetup() error {
    // Initialize Vault client with default config (reads VAULT_ADDR, VAULT_TOKEN from env)
    client, err := vault.NewClient(vault.DefaultConfig())
    if err != nil {
        return fmt.Errorf("failed to create Vault client: %w", err)
    }

    // Authenticate with AppRole (production-grade auth method)
    roleID := "trivy-scan-role"
    secretID := "trivy-scan-secret" // In prod, fetch from secure env var
    appRoleAuth, err := auth.NewAppRoleAuth(roleID, &auth.SecretID{FromString: secretID})
    if err != nil {
        return fmt.Errorf("failed to create AppRole auth: %w", err)
    }

    // Login to Vault with AppRole
    ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
    defer cancel()
    _, err = client.Auth().Login(ctx, appRoleAuth)
    if err != nil {
        return fmt.Errorf("failed to login to Vault: %w", err)
    }

    // Enable Transit secrets engine at transit/ path
    err = client.Sys().Mount("transit", &vault.MountInput{
        Type:        "transit",
        Description: "Transit engine for Trivy scan credential encryption",
    })
    if err != nil {
        // Ignore error if already mounted (idempotent setup)
        if !vault.IsStatusCode(err, 400) {
            return fmt.Errorf("failed to mount transit engine: %w", err)
        }
        log.Println("Transit engine already mounted, skipping")
    }

    // Create encryption key for Trivy scan metadata
    _, err = client.Logical().Write("transit/keys/trivy-scan-key", map[string]interface{}{
        "type":        "aes256-gcm96",
        "auto_rotate": true,
        "rotation_period": "24h",
    })
    if err != nil {
        return fmt.Errorf("failed to create transit key: %w", err)
    }

    // Create role for Trivy scan credentials with 15-minute TTL
    _, err = client.Logical().Write("transit/roles/trivy-scan-role", map[string]interface{}{
        "ttl":            "15m",
        "max_ttl":        "1h",
        "allowed_roles":  []string{"trivy-scan"},
        "token_policies": []string{"trivy-scan-policy"},
    })
    if err != nil {
        return fmt.Errorf("failed to create transit role: %w", err)
    }

    log.Println("Vault Transit engine setup complete for Trivy integration")
    return nil
}

func main() {
    if err := vaultTrivySetup(); err != nil {
        log.Fatalf("Setup failed: %v", err)
    }
}

#!/usr/bin/env python3
"""
Trivy scan runner that generates Vault-signed SBOM attestations
Requires: trivy>=0.48.0, hvac>=1.2.1, sigstore>=2.0.0
"""

import os
import sys
import subprocess
import json
import tempfile
from datetime import datetime, timedelta

import hvac

# GitHub repo for hvac (Vault Python client): https://github.com/hvac/hvac
VAULT_ADDR = os.getenv("VAULT_ADDR", "https://vault.example.com:8200")
VAULT_TOKEN = os.getenv("VAULT_TOKEN")
TRIVY_SCAN_PATH = os.getenv("TRIVY_SCAN_PATH", ".")
ATTESTATION_TTL = timedelta(minutes=15)

def init_vault_client():
    """Initialize Vault client with AppRole auth"""
    if not VAULT_TOKEN:
        print("Error: VAULT_TOKEN environment variable not set", file=sys.stderr)
        sys.exit(1)

    client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
    if not client.is_authenticated():
        print("Error: Failed to authenticate to Vault", file=sys.stderr)
        sys.exit(1)
    return client

def run_trivy_scan(image_ref):
    """Run Trivy SBOM scan and return raw SBOM JSON"""
    try:
        result = subprocess.run(
            ["trivy", "sbom", image_ref, "--format", "cyclonedx-json"],
            capture_output=True,
            text=True,
            check=True
        )
        return json.loads(result.stdout)
    except subprocess.CalledProcessError as e:
        print(f"Trivy scan failed: {e.stderr}", file=sys.stderr)
        raise
    except json.JSONDecodeError as e:
        print(f"Failed to parse Trivy SBOM: {e}", file=sys.stderr)
        raise

def sign_sbom_with_vault(vault_client, sbom_json):
    """Sign SBOM with Vault PKI intermediate CA for attestation"""
    # Fetch signing certificate from Vault PKI secrets engine
    secret = vault_client.secrets.pki.generate_certificate(
        role="trivy-attestation-role",
        common_name=f"trivy-sbom-{datetime.utcnow().isoformat()}",
        ttl=ATTESTATION_TTL
    )

    # Write SBOM to temp file for signing
    with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
        json.dump(sbom_json, f)
        sbom_path = f.name

    try:
        # Use sigstore to sign SBOM with Vault-issued certificate
        subprocess.run(
            ["cosign", "sign-blob", sbom_path, "--cert", secret["data"]["certificate"], 
             "--key", secret["data"]["private_key"], "--output-certificate", f"{sbom_path}.pem",
             "--output-signature", f"{sbom_path}.sig"],
            check=True,
            capture_output=True
        )

        with open(f"{sbom_path}.sig", "r") as sig_f:
            signature = sig_f.read()
        with open(f"{sbom_path}.pem", "r") as cert_f:
            cert = cert_f.read()

        return {
            "sbom": sbom_json,
            "signature": signature,
            "signing_cert": cert,
            "issued_at": datetime.utcnow().isoformat()
        }
    finally:
        # Cleanup temp files
        os.unlink(sbom_path)
        if os.path.exists(f"{sbom_path}.sig"):
            os.unlink(f"{sbom_path}.sig")
        if os.path.exists(f"{sbom_path}.pem"):
            os.unlink(f"{sbom_path}.pem")

def main():
    if len(sys.argv) < 2:
        print("Usage: trivy_vault_attest.py ", file=sys.stderr)
        sys.exit(1)

    image_ref = sys.argv[1]
    vault_client = init_vault_client()

    print(f"Running Trivy SBOM scan for {image_ref}...")
    sbom = run_trivy_scan(image_ref)

    print("Signing SBOM with Vault PKI...")
    attestation = sign_sbom_with_vault(vault_client, sbom)

    # Write attestation to file
    output_path = f"trivy-attestation-{image_ref.replace('/', '-')}.json"
    with open(output_path, "w") as f:
        json.dump(attestation, f, indent=2)

    print(f"Attestation written to {output_path}")

if __name__ == "__main__":
    main()

name: Unified Vault-Trivy Compliance Pipeline

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  VAULT_ADDR: https://vault.example.com:8200
  TRIVY_VERSION: 0.48.0
  VAULT_VERSION: 1.15.0

jobs:
  compliance-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # Required for OIDC auth to Vault

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Vault CLI
        run: |
          wget -q https://releases.hashicorp.com/vault/${{ env.VAULT_VERSION }}/vault_${{ env.VAULT_VERSION }}_linux_amd64.zip
          unzip vault_${{ env.VAULT_VERSION }}_linux_amd64.zip
          sudo mv vault /usr/local/bin/
          vault version
        shell: bash

      - name: Install Trivy CLI
        run: |
          wget -q https://github.com/aquasecurity/trivy/releases/download/v${{ env.TRIVY_VERSION }}/trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.tar.gz
          tar -xzf trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.tar.gz
          sudo mv trivy /usr/local/bin/
          trivy version
        shell: bash

      - name: Authenticate to Vault via OIDC
        id: vault-auth
        run: |
          # Use GitHub OIDC to authenticate to Vault (no static secrets!)
          vault login -method=oidc role=github-actions-role
          echo "VAULT_TOKEN=$(vault print token)" >> $GITHUB_ENV
        shell: bash

      - name: Run Trivy container scan with Vault-signed SBOM
        run: |
          # Scan container image and generate SBOM
          trivy image --format cyclonedx-json --output sbom.json ${{ github.repository }}:${{ github.sha }}

          # Fetch short-lived Trivy API token from Vault
          TRIVY_TOKEN=$(vault read -field=token secret/trivy-scan-tokens)
          echo "TRIVY_TOKEN=$TRIVY_TOKEN" >> $GITHUB_ENV

          # Run vulnerability scan with token
          trivy image --token $TRIVY_TOKEN --severity HIGH,CRITICAL --output vuln-report.json ${{ github.repository }}:${{ github.sha }}
        shell: bash

      - name: Sign attestation with Vault PKI
        run: |
          # Generate signing cert from Vault PKI
          vault write pki/issue/trivy-attestation-role common_name=trivy-scan-${{ github.run_id }} ttl=15m

          # Sign SBOM and vuln report
          cosign sign-blob sbom.json --cert pki-cert.pem --key pki-key.pem --output-signature sbom.sig
          cosign sign-blob vuln-report.json --cert pki-cert.pem --key pki-key.pem --output-signature vuln.sig
        shell: bash

      - name: Upload compliance artifacts
        uses: actions/upload-artifact@v3
        with:
          name: compliance-artifacts
          path: |
            sbom.json
            sbom.sig
            vuln-report.json
            vuln.sig
            pki-cert.pem
          retention-days: 30

      - name: Check compliance pass/fail
        run: |
          # Fail pipeline if critical vulnerabilities found
          CRITICAL_COUNT=$(cat vuln-report.json | jq '.vulnerabilities | length')
          if [ $CRITICAL_COUNT -gt 0 ]; then
            echo "Error: $CRITICAL_COUNT critical vulnerabilities found"
            exit 1
          fi
        shell: bash

# Fetch short-lived Trivy token from Vault (15m TTL)
TRIVY_TOKEN=$(vault read -field=token secret/trivy-scan-tokens)
trivy image --token $TRIVY_TOKEN myapp:latest

# Generate Vault-signed Trivy SBOM attestation
trivy sbom --format cyclonedx-json --output sbom.json myapp:latest
vault write pki/issue/trivy-attestation-role common_name=sbom-scan ttl=15m
cosign sign-blob sbom.json --cert pki-cert.pem --key pki-key.pem

# Bash retry function for Vault requests
retry_vault() {
  for i in {1..5}; do
    vault "$@" && return 0
    sleep $((2 ** i + RANDOM % 10))
  done
  echo "Vault request failed after 5 retries" >&2
  exit 1
}
retry_vault read secret/trivy-token