Role-based access control for container and IaC Security

You can configure role-based access control (RBAC) for container and infrastructure as code (IaC) scans to restrict access to scan findings. With RBAC, developers can view findings only for applications assigned to their teams.

Role-based access control provides:

• Improved security as it limits developer visibility to their team's applications.
• Granular access controls when multiple teams are involved.
• Integration with RBAC configuration for other scan types, such as DAST, SAST, SCA, and MPT.

How RBAC works

For container and IaC Security, RBAC follows a three-step process:

1. Link container and IaC scans to a new or existing application profile.
2. Assign teams to the application profile.
3. The system validates user permissions and team membership before showing findings.

With RBAC, reviewers can view findings only for applications assigned to their teams. Security Leads have unrestricted access to all findings. Scans not linked to any application profile are only visible to Security Leads.

Implement RBAC

Prerequisites

Before you begin, ensure you have:

• API or UI user account with appropriate roles:

  • API User: Upload and Scan API or Upload API - Submit Only
  • UI User: Creator, Security Lead, or Submitter

• Teams for application profiles created in the Veracode Platform.

• Team membership in at least one team assigned to your application profiles.

Step 1: Link scans to application profiles

RBAC is implemented using application profiles and teams. First, link container and IaC scans to an application profile.

To complete this task:

To link a scan to an existing application profile, run:

veracode scan --source ./ --type directory --app-name my-existing-app

To create an application profile and then link a scan to it, use the --create-app flag:

veracode scan --source ./ --type directory --app-name new-app --create-app

Choose consistent, descriptive names that reflect the application's purpose and team ownership.

When you use the --create-app flag without specifying an application profile name by using the --app-name flag, the application profile name is generated automatically in one of the following formats:

• For IaC scans: git-org-name/git-repo-name
• For container scans: image-name:tag-name

Step 2: Assign teams to application profiles

Assign teams to application profiles from the Veracode Platform. You must have the Security Lead role to complete this step.

For the process on assigning teams to application profiles, see Add teams to application profiles.

Step 3: Access scan results

Developers view container and IaC findings for the application profiles in their teams.

For details on accessing scan results, see Access the scan results

note

Results of container and IaC scans are available only in the Container & IaC Analysis section of the Veracode Platform. The results are currently not available in the application profile section of the Veracode Platform.

Assigning teams when performing a scan

When scanning a new application profile, you can assign teams directly via the CLI:

To create and assign an application profile to a team when performing a scan, use the --create-app flag along with the --teams flag:

veracode scan --source ./ --type directory --app-name new-app --create-app --teams devops

Team names must be comma-separated, and with no spaces. The teams must exist in the Veracode Platform.

note

• The --teams flag can only be used along with the --create-app flag. If you don't use the --teams flag with the --create-app flag, the application profile is assigned to all teams that the user belongs to.
• You must have the permission to assign applications to these teams.

Following is an example on assigning multiple teams when performing a scan:

veracode scan --source ./ --type directory --app-name backend-api --create-app --teams backend d-team,devops-team,platform-engineering

RBAC - usage examples

The following examples demonstrate scenarios in which RBAC is implemented.

Example 1: Onboarding a new team

To allow the mobile-dev team to view findings for the mobile-app application, complete the following steps:

1. Ensure the mobile-dev team exists in the Veracode Platform.
2. Scan with the application profile: veracode scan --source ./ --type directory --app-name mobile-app.
3. In the Veracode Platform, assign the mobile-dev team to the mobile-app application profile.

Users in mobile-dev can now view findings in the mobile-app application.

Example 2: Share an application across multiple teams

To allow the backend-team and devops-team teams to view findings for the api-server application, complete the following steps:

1. Ensure that the api-server application profile exists in the Veracode Platform.
2. In the Veracode Platform, assign the backend-team and devops-team teams to the api-server application profile.

Users in the backend-team and devops-team teams can now view findings for the api-server application. Users who are not members of either team cannot view the findings.

Example 3: Create an application profile with immediate team access

To create the new-service application profile and allow the platform-team team to view findings for this profile, complete the following steps:

1. Create and assign the new-service application profile to the platform-team team when performing a scan: veracode scan --source ./ --type directory --app-name new-service --create-app --teams platform-team
2. In the Veracode Platform, verify that the new-service application profile was created and that the platform-team team is assigned to it.

Users in the platform-team team can now view findings in the new-service application. If additional teams must access the new-service application profile, assign those teams to this application profile in the Veracode Platform.

Example 4: Remove team access for an application profile

To prevent the old-team team from viewing findings for the legacy-app application profile, complete the following steps:

1. In the Veracode Platform, locate the legacy-app application profile.
2. Unassign the old-team team from the application profile.

Users in the old-team team can no longer view findings for the legacy-app application.

Troubleshooting

Issue	Cause	Solution
Application Profile Not Found	The specified application profile does not exist, and the --create-app flag was not used with the veracode scan command.	Use the --create-app flag with the veracode scan command to create the application profile. If you are using an existing application profile, verify that you specified the correct application profile name.
Permission Denied or Insufficient Permissions	Your user account does not have the required roles or permissions.	Verify that you have one of the required roles: API users: Upload and Scan API or Upload API - Submit Only UI users: Creator, Security Lead, or Submitter
Team Not Found when using --teams	The specified team does not exist, or the team name contains a typo.	Verify the team name in the Veracode Platform, including its spelling and formatting. Also, ensure that you have permission to assign teams to applications.
Cannot Create Application Profile	The createApplicationProfile permission is missing, or there are issues with team assignments.	Ensure that your account has a role that has the createApplicationProfile permission. Also, verify that the specified teams exist and that you are a member of at least one of them.
Developer Can't See Scan Results	The developer is not added to a team that has access to the application profile.	Check if application name for the scan is correct and teams are assigned to the profile. Also, if the developer is not added to the team, add the developer to it.

note

For issues where you don't have the required role or permission, contact your Veracode administrator.

Permission reference

Common tasks

Task	Permission	Team/ Role
Submitting scans to existing applications	submitIaCScan, submitContainerScan	Member of a team assigned to the application profile
Creating new application profiles	createApplicationProfile, submitIaCScan, submitContainerScan	Member of all teams assigned to the new application profile
Viewing scan results	viewContainerResults, viewIaCResults	Member of a team assigned to the application profile, unless you're a Security Lead
Managing teams and assignments	Administrative access to team and application profile management	The Administrator or Security Lead role

Permissions list

• Manage application profiles
• Veracode Container Security

Additional resources

• Veracode Platform basics
• Veracode administration
• Manage application profiles
• Manage teams in Veracode
• Scan containers, IaC, and secrets