AWS CodeBuild - Administrator Guide - Cortex XSIAM - Cortex Cloud Posture Management - Cortex CLOUD - Cortex - Security Operations

version: 0.2

env:
  variables:
    CORTEX_API_URL: "https://api-viso-hdkbzk6qphxpbehy758elo.xdr-qa2-uat.us.paloaltonetworks.com"
    CORTEX_CLI_VERSION: "0.8.11"
  secrets-manager:
    CORTEX_API_KEY: "CORTEX_API_KEY"
    CORTEX_API_KEY_ID: "CORTEX_API_KEY_ID"

phases:
  install:
    runtime-versions:
      docker: 19
    commands:
      - echo "Installing dependencies"
      - yum -y update
      - yum -y install jq curl

  pre_build:
    commands:
      - echo "Fetching temporary token"
      - |
        export TOKEN_RESPONSE=$(curl --location "${CORTEX_API_URL}/public_api/cas/v1/cortex-cli/create-token" \
                                 --header "Authorization: ${CORTEX_API_KEY}" \
                                 --header "x-xdr-auth-id: ${CORTEX_API_KEY_ID}" \
                                 --header "Content-Type: application/json" \
                                 --data "{}" -s)
      - export TEMP_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.token')
      - echo "Temporary token fetched"

      - echo "Pulling Docker image"
      - docker pull --platform linux/arm64 distributions-dev.traps.paloaltonetworks.com/cli-docker/${TEMP_TOKEN}/method:arm64-${CORTEX_CLI_VERSION}-dev

      - echo "Tagging Docker image"
      - docker tag distributions-dev.traps.paloaltonetworks.com/cli-docker/${TEMP_TOKEN}/method:arm64-${CORTEX_CLI_VERSION}-dev cortexcli:${CORTEX_CLI_VERSION}

      - echo "Setting Extra Environment Variables"
      - |
        export CODEBUILD_ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
        export CODEBUILD_GIT_BRANCH="$(git symbolic-ref HEAD --short 2>/dev/null)"
        if [ "$CODEBUILD_GIT_BRANCH" = "" ] ; then
          export CODEBUILD_GIT_BRANCH="$(git rev-parse HEAD | xargs git name-rev | cut -d' ' -f2 | sed 's/remotes\/origin\///g')"
        fi
        export CODEBUILD_PROJECT=${CODEBUILD_BUILD_ID%:$CODEBUILD_LOG_PATH}

        echo "==> AWS CodeBuild Extra Environment Variables:"
        echo "==> CODEBUILD_ACCOUNT_ID = $CODEBUILD_ACCOUNT_ID"
        echo "==> CODEBUILD_GIT_BRANCH = $CODEBUILD_GIT_BRANCH"
        echo "==> CODEBUILD_PROJECT = $CODEBUILD_PROJECT"

  build:
    commands:
      - echo "Running Docker container"
      - |
        docker run --rm --platform linux/arm64 cortexcli:${CORTEX_CLI_VERSION} \
                   --api-base-url ${CORTEX_API_URL} \
                   --api-key ${CORTEX_API_KEY} \
                   --api-key-id ${CORTEX_API_KEY_ID} \
                   code scan \
                   --directory . \
                   --repo-id $CODEBUILD_ACCOUNT_ID/$CODEBUILD_PROJECT \
                   --branch $CODEBUILD_GIT_BRANCH