Adding IAC check for secrets inserted into docker layer

[tzurielweisberg]

Description

Wbserved recently that when the secrets are passed to docker build with --build-args, it saved into the image layers unexposed and that leads to a secret leak if someone inspects the image layers or reviews the scan layers from Aqua UI for the scanned image.

We need a IAC rule for Dockefile to search for Secrets/Password usage.

It of course will be matched in secret scanning later, but we want to know about it before

Target

Filesystem

Scanner

Misconfiguration

[simar7]

@nikpivkin could you take a look at this?

[nikpivkin]

@tzurielweisberg Check should use heuristic algorithms to detect possible uses of credentials? We may encounter false positives, especially for keywords like “PSW”.

[nikpivkin]

Track #7639