A CircleCI Orb that automates static security analysis and compliance auditing of Infrastructure-as-Code repositories using Bridgecrew.
This CircleCI Orb Action runs Bridgecrew analysis of Infrastructure-as-Code repository. Bridgecrerw performs static security analysis of Terraform, CloudFormation and Kubernetes Infrastructure code security
This tool is used by DevOps and security teams to integrate automated security scanning of Terraform, CloudFormation, and Kubernetes IaC files directly into CircleCI workflows. It helps identify and remediate infrastructure configuration errors early in the CI/CD pipeline, ensuring compliance and reducing security risks.
Ensure the Bridgecrew API key or Prisma Cloud access key is securely stored as an environment variable. Use the soft-fail option to prevent pipeline failures during scanning while still reporting issues. For Prisma Cloud integration, the API key must be in the format <access_key_id>::<secret_key> and the appropriate API URL set. Leverage the free Bridgecrew Community plan for unlimited scans and user access without additional cost.
Enable usage of CircleCI Orbs in your project workflow following the Orb Quick Start Guide at https://circleci.com/orbs/registry/orb/bridgecrew/bridgecrew#quick-start
Set up an environment variable with your Bridgecrew API key from your Bridgecrew account at https://www.bridgecrew.cloud/integrations
Optionally, set Prisma Cloud API URL environment variable if using Prisma integrationbridgecrew/scan: directory: '.' soft-fail: true api-key-variable: BC_API_KEY prisma-api-url: PRISMA_API_URL
Scans the entire IaC directory for security issues, allowing the build to continue even if vulnerabilities are found.
bridgecrew/scan: file: './terraform/db-app.tf' api-key-variable: BC_API_KEY prisma-api-url: PRISMA_API_URL
Scans a specific Terraform file for security and compliance issues.
bridgecrew/scan: directory: './terragoat' soft-fail: true api-key-variable: BC_API_KEY prisma-api-url: PRISMA_API_URL
Advanced example scanning a specified directory with soft-fail enabled and Prisma Cloud API integration.