New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer
Product tourGet a demo

Jenkins pipelines, judged from the Jenkinsfile

There is nothing to install on Jenkins. CloudLens reads the Jenkinsfile in every repository you connect from GitHub, GitLab, Bitbucket or Azure DevOps, flags the risky patterns, and traces the AWS roles and keys each pipeline uses.

Get a demoAll integrations
What you're watchinglive product
  1. 1
    The Jenkinsfile is read from the repo

    payments-service's Jenkinsfile is parsed on every scan; nothing runs.

  2. 2
    Four risky lines are flagged

    An unpinned @Library, agent any, a long-lived AWS key and a build parameter inside sh.

  3. 3
    Traced to the cloud

    The pipeline's key and the deploy-prod role are mapped to what they can change in prod-core.

Who does thisPlatform lead who owns the Jenkins pipelinesWhat you getRisky pipeline patterns are found without touching Jenkins.
Nothing on JenkinsNo plugin, no agent, no controller access
Parsed, never runThe Jenkinsfile is read as text
Keys and roles foundStatic AWS keys, role ARNs, parameters in sh
9 Jenkins rulesCL-JNK-001 to 010

Pipelines hold the keys to production

A Jenkinsfile is code that deploys code — and the one file nobody reviews for security.

Secrets

Deleted is not gone

What usually happens: A developer removes a cloud key from the code. It stays in git history, readable by anyone who can clone the repository.

How CloudLens resolves it: Gitleaks reads the last 2,000 commits too, so the key is found, rotated and purged.

Resolved
Review

Reviewers miss what scanners catch

What usually happens: A pull request adds a live payment key in a config file. Two approvals later, it is on main.

How CloudLens resolves it: The repository's scans judge the Jenkinsfile on every change to it.

Resolved
Pipelines

CI has production access

What usually happens: Jenkins holds long-lived cloud keys or an over-trusting role, and nobody connects it to what it can change.

How CloudLens resolves it: Every pipeline file is judged line by line, and its role or key is traced to the AWS resources it can reach.

Resolved

Nothing to install on Jenkins

There is nothing to install on Jenkins. Connect the repositories that hold your Jenkinsfiles; CloudLens finds and reads them on every scan.

The Jenkinsfile is parsed as text, never executed · CloudLens never talks to your Jenkins server.

  • Jenkinsfile in the repo · read
  • Jenkins controller · not requested
  • Jenkins credentials · not requested
What you're watchinglive product
  1. 1
    Pick the code host

    Jenkinsfiles are read from the repositories you connect; here they live in GitHub.

  2. 2
    See exactly what is granted

    Jenkinsfile in the repo: Read · Jenkins controller: Not requested · Jenkins credentials: Not requested.

  3. 3
    Repositories are found and scanned

    3 repositories in every repository you connect from GitHub, GitLab, Bitbucket or Azure DevOps start their first scan.

Who does thisAdmin connecting the source in CloudLens SettingsWhat you getCloudLens can read the code, and nothing else.

Jenkins, judged line by line

Jenkinsfile is parsed as text — never executed — and every risky line is flagged with its rule and severity.

The roles and long-lived keys a pipeline uses are matched to your AWS inventory. So you see what a compromised pipeline could change in production.

  • shared library not pinned to a version
  • runs on any agent, including shared ones
  • long-lived AWS key in the Jenkinsfile
  • build parameter interpolated into sh
What you're watchinglive product
  1. 1
    Open Jenkinsfile

    4 lines are flagged as the file is read.

  2. 2
    Each line gets a rule and severity

    CL-JNK-001: shared library not pinned to a version · CL-JNK-009: runs on any agent, including shared ones.

  3. 3
    Traced to the cloud

    The deploy-prod role leads to the checkout-api service and orders-db in prod-core.

Who does thisPlatform engineer who owns the pipelinesWhat you getPipeline risk is ranked by what it can reach in production.

What CloudLens reads in Jenkins today

Straight from the product. Where something is not assessed, we say so rather than imply it.

Capability
Status
Details
Jenkinsfile in connected repos
Yes
Found and parsed on every repository scan
Unpinned @Library
Yes
CL-JNK-001
curl | sh, printed secrets, install scripts
Yes
CL-JNK-002 to 004
Static AWS keys, unpinned images, deploy on PR
Yes
CL-JNK-005 to 007
agent any · parameters in sh
Yes
CL-JNK-009 and 010
Pipeline → cloud
Partly
Role ARNs matched to AWS roles; static keys flagged
Jenkins controller, jobs and plugins
Not today
Not read — CloudLens has no Jenkins connector
Jenkins credentials store and agents
Not today
Not read

One week with Jenkins connected

Lumora Retail is a fictional company. The steps are how CloudLens behaves.

MLMarcus LeePlatform lead, Lumora Retail

Lumora Retail is a fictional company. The people, names and numbers are sample data.

    1
    Mon 09:30No agent

    Connects the repositories, not Jenkins

    The Jenkinsfiles live in GitHub, so connecting GitHub is all it takes. Jenkins itself is untouched.
    2
    Mon 10:10Critical

    Finds a key in the environment block

    payments-service's Jenkinsfile sets AWS_ACCESS_KEY_ID in environment {}. CL-JNK-005 flags it Critical.
    3
    Wed 14:00

    Pins the shared library

    Every pipeline loaded @Library('shared-pipeline') without a version. Marcus pins it, and CL-JNK-001 clears on the next scan.
Wondering what your Jenkinsfiles hide?

Scan your repositories with read-only access

Get a demo

The rest of your code and CI

GitHub

GitHub App · github.com

Learn more

GitLab

Group access token · gitlab.com or your self-managed GitLab

Learn more

Bitbucket

Workspace access token · Bitbucket Cloud

Learn more

Azure DevOps

Personal access token · dev.azure.com

Learn more

Read-only

CloudLens never pushes, comments or merges. On GitHub, the one write is a check run, and only if you grant Checks: write.

History included

Secrets are looked for in the last 2,000 commits within a year, not just today's files.

Code to cloud

Container images, Terraform and pipeline roles are matched to the AWS resources they run as or deploy.

One finding list

Code findings sit next to cloud findings in Atlas, with the same Jira, Slack and Teams actions.

Jenkins FAQ

No. CloudLens has no Jenkins connector: it reads the Jenkinsfile from the repositories you connect through GitHub, GitLab, Bitbucket or Azure DevOps.

No. The Jenkins controller, jobs, plugins, credentials store and agents are not read. Only what is in the Jenkinsfile is judged.

Unpinned shared libraries, curl | sh, printed secrets, install scripts, static AWS keys, unpinned images, deploys on pull requests, agent any, and build parameters interpolated into sh.

Never. It is parsed as text.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.