DevSecOps with AWS – Cloud-native development – Secure IDEs Cloud9 - Part 1
Tags: aws, devsecops, devops, cdk
Published: 2022-11-28 00:29:28

**_Level 200_**

**Table of Contents**

- [Hands On](#hands-on)
  - [Requirements](#requirements)
  - [AWS Services](#aws-services)
  - [Solution Overview](#solution-overview)
    - [Conditions](#conditions)
    - [User management](#user-management)
    - [Developer IAM role](#developer-iam-role)
    - [Step by Step](#step-by-step)
    - [Clean up](#clean-up)

In previous posts you can find some examples about how to use AWS CDK and security at scale for application deployments in AWS, now suppose that you need use cloud environments for control and manage those deployments using just the tools require for your organization, manage and audit developer’s sessions and control traffic. Furthermore, you need to homologate and deploy different environments with custom tools, SDKs, plugins, and software. In this series you will learn how the AWS services can help you to accomplish this task, some alternatives, applying security in depth and IaC.

> If you want to explore Cloud9 and end to end development environment in AWS use AWS Codestar.

AWS Cloud9 is the principal service that can help you to solve this challenge, **a cloud-based IDE that allows you to write, execute, and debug code through the web browser**. AWS Cloud9 contains pre-installed software and tools for language such as Python, Ruby, Go, PHP and others, AWS CLI, and **direct integration with services such as AWS Lambda and CodeCommit**. **Key features of AWS Cloud9 include an integrated code debugger, built-in terminal, collaborative chat and editing, and connectivity to any Linux server platform.**  To know more about these features, you can read the service’s details.

> Also, you can use AWS Cloud9 as backup of your local IDE or emergency IDE.

There are two types of scenarios for deploying these environments: 
1.**Environment where the connection is through SSH**, at this point the security groups will have an access rule to 22 to a set of IPs. This environment can be configured from a new instance or to an existing server.
2.**Environment using AWS Systems Manager for connection**. In this scenario, security groups will have no inbound rules, and through SSM Agent communication between cloud9 and the managed Amazon EC2 instance is ensured.

According to requirements the best option is Environment using AWS Systems Manager for connections, because the manage EC2 instance wouldn’t be expose to internet and the connection for management keep secure with SSM agent.

Before the hands on remember **some key advantages to use Session Manager**, Session Manager provides a secure and auditable way to access compute nodes, not only for Amazon EC2, but also for services such as Fargate and CodeBuild, in addition:

1.It is compatible with Linux and Windows operating systems.
2.Eliminates the need to create bastion hosts, add exceptions to the firewall, and manage SSH keys.
3.Centralizes access controls via IAM.
4.Save session activity and send logs to Amazon Cloudwatch logs, S3, and/or CloudTrail.
5.Improves the security posture for instance management by using VPC interface endpoints and preventing communication from going online.
6.It enables investigation and remediation of DevOps teams and incident resolution through instant and secure access.

# Hands On

## Requirements 

- cdk >= 2.51.1
- AWS CLI >= 2.7.0
- Python >= 3.10.4
- Pytest >= 7.1.3
- cdk-nag >=2.18.44
- checkov >= 2.1.229

## AWS Services
- [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/): is an open-source software development framework to define your cloud application resources using familiar programming languages.
- [AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/?nc2=h_ql_prod_se_iam): Securely manage identities and access to AWS services and resources.
- [AWS IAM Identity Center (Successor to AWS Single Sign-On)](https://aws.amazon.com/iam/identity-center/): helps you securely create or connect your workforce identities and manage their access centrally across AWS accounts and applications.
- [AWS CodeCommit](https://aws.amazon.com/codecommit/): secure, highly scalable, managed source control service that hosts private Git repositories.
- [AWS Key Management Service (AWS KMS)](https://aws.amazon.com/kms/): lets you create, manage, and control cryptographic keys across your applications and more than 100 AWS services.
- [AWS CloudFormation](https://aws.amazon.com/cloudformation/): Speed up cloud provisioning with infrastructure as code
- [AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/?nc2=h_ql_prod_se_iam): Securely manage identities and access to AWS services and resources.
- [AWS Cloud 9](https://aws.amazon.com/cloud9/?nc2=h_ql_prod_dt_c9): A cloud-based IDE that lets you write, run, and debug your code through a browser. 
- [AWS Lambda](https://aws.amazon.com/lambda/?nc2=h_ql_prod_cp_lbd): A serverless compute service that lets you run code without provisioning or managing servers, build workload-based cluster scaling logic, maintain event integrations, or manage runtimes.
- [AWS Systems Manager](https://aws.amazon.com/systems-manager/?nc2=h_ql_prod_mg_sm) – This is the AWS Operations Center. Systems Manager provides a unified user interface so you can track and resolve operational issues across all your AWS applications and resources from one place.

## Solution Overview

### Conditions 

- Source code can only be cloned from a development VPC (DevVPC). 
- AWS Cloud9 environments can only be created in a DevVPC in central account.
- VPC flow logs are enabled on DevVPC. 

### User management 

- Amazon Single Sign-On, AD, IAM users, etc.
- Developers are assigned an IAM role.
- The user’s sessions should be logged and audited.

### Developer IAM role 

- Gives access to source code in CodeCommit 
- Allows using AWS Cloud9 



![Secure Cloud Native IDE](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a80tij8ubhx2jlaq3cyo.png)
Figure 1. Solution overview- Secure Cloud Native IDE



Figure 1 shows the reference architecture diagram for this scenario. You can see that the **login to the environment will be through SSO**, use of IAM for custom roles and integration with CodeCommit that allows us to clone without the need for additional steps our repositories within the environment, **network segmentation, the use of AWS Network Firewall and VPC Endpoints to connect privately to AWS Systems manager** and thus be able to apply more controls aligned with the **principle of minimum exposure and security in depth.** In order to guarantee the traceability and auditing of the sessions, the Session Manager preferences are configured to send the encrypted logs to an S3 Bucket and Cloudwatch which will allow to the security team to analyze and automate to respond to any event or unwanted behavior of our users on the environments.

For other hand, the CDK code have some custom actions for managing and add features to your environment. For example,



![Custom Resources](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4bfsb6jjhhnshgbh01te.png)
Figure 2. Custom Resources



Figure 2 shows a diagram of the main components of the CDK project, we can see three custom Cloudformation resources that correspond to the lambdas functions responsible for: 
1.	Resize the disk of the Cloud9 instance.
2.	Assign a custom role, it can be a role with managed policies or a custom role.
3.	Install additional custom tools that are not in the default environment. This boostrap command just run one time. For this task we will use the Run-Command functionality within Systems Manager.
If you want to run every time there are many alternatives, for example, modify the custom resource events for run after run command actions after each code update

> **If you want to encrypt the EBS volume, please enable default encryption for each region and account**.

### Step by Step

> You can find the code here.
{% embed https://github.com/velez94/cdk_c9_secure_ides %}

1- Understand the project structure.
The CDK project has the following structure, as is usual the project properties are in `yaml` file in `project_configs` folder.
  

```commandline
.
├── app.py
├── cdk.context.json
├── cdk.json
├── cdk.out
├── __init__.py
├── project_configs
│   ├── environment_options
│   │   ├── environment_options_example.yaml
│   │   └── project_1
│   ├── environment_options_example.yaml
│   ├── helpers
│   │   ├── helper.py
│   │   ├── __init__.py
│   │   ├── project_configs.py
│   ├── images
│   │   ├── DevSecOps-labs-Cloud-native development with AWS-ArchOverview.png
│   │   └── diagram.png
│   ├── __init__.py
│       └── __init__.cpython-310.pyc
├── README.md
├── requirements-dev.txt
├── requirements.txt
├── source.bat
├── src
│   ├── cdkv2_secure_ides_c9_aws_stack.py
│   ├── __init__.py
│   ├── lib
│   │   ├── customs
│   │   ├── ides
│   │   ├── __init__.py
│   │   ├── cdkv2_secure_ides_c9_aws_stack.cpython-310.pyc
│   └── stacks
│       ├── __init__.py
│       ├── network
└── tests
    ├── __init__.py
    └── unit
        ├── __init__.py
        └── test_cdkv2_secure_ides_c9_aws_stack.py

```



2- Modify project properties 
For this setup the project properties are in `project_configs/environment_options/project_1/environment_options.yaml`, the code is created for deployment and manage many environments in different accounts you can setup each one creating a folder  like `project_configs/environment_options/<project_name>/environment_options.yaml`,  and setup an environment variable for synth and deploy. Also, you can create many environments for the same account in the `environment_props` block.

```bash
export props_paths='../environment_options/project_1/environment_options.yaml'
```

Create a environment options file like: 

```yaml
project_name: 'CloudNativeIDEs'

# DevSecOps Account Environment setup
devsecops_account: "123456789012"
devsecops_region: "us-east-1"


network_definitions:
  create_vpc: True
  vpc_cidr: "192.168.0.0/16"
  max_azs: 2
  nat_gateways: 0
  subnet_configuration:
      - name: "public"
        cidr_mask : 24
        subnet_type : "public"
      - name: "ides"
        cidr_mask : 24
        subnet_type : "isolate"

environment_props:
  - environment_name: 'DevSecOpsIDE-Project'
    description: "DevSecOps IDE Blog"
    instance_size: 't3.small'
    automatic_stop_time_minutes: 30
    resize_volume: "True"
    ebs_volume_size: '17'
    bootstrap_environment: "True"
    bootstrap_commands: 'bootstrap.sh'
    subnet_type: 'public'
    owner_arn: 'arn:aws:sts:: 123456789012:assumed-role/AWSReservedSSO_LabxlDevSecOpsRW_a4790b6a3d6c520a/DevSecOpsAdm'

    codecommit_repos:
      - 'MyREPO'

# Tags definitions align with enterprise instructions
tags:
  - key: 'Project'
    value: 'SecureIdes'
  - key: 'Stack'
    value: 'SecureIdes'
  - key: 'Environment'
    value: 'Prod'


```
In this example you can find the network definitions and environment definitions blocks. You can enable or disable custom actions and use codecommit repositories, if you don want clone codecommit repositories comment the lines.
The boostrap_commands parameter indicates the path of bootstrap shell script file. For example:

```bash
#!/bin/bash

sudo yum update -y
sudo yum upgrade -y
sudo yum install -y yum-utils
echo "bootstrapping environment"> /home/ec2-user/environment/bootstrap-file.txt

```

> This file is in the same project folder, use with precaution and scripts certificated for correct deployment.

3- Synth code and deploy.

Verify the stacks. 
```bash
$ cdk ls
CdkSecureIDEsVPCStack
Cdkv2SecureIDEsCloud9AWSStack
```
The VPC stack don’t create a network firewall this task will be posted in other blog, if you want learn more about this service please visit [Deployment models for AWS Network Firewall | Networking & Content Delivery (amazon.com)](https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/)

Setup AWS CLI profile using [aws configure](aws configure) command for DevSecOps Account.

```bash
aws configure sso --profile labxl-devsecops
SSO start URL [None]: https://my-sso-portal.awsapps.com/start
SSO region [None]:us-east-1
Using a browser, open the following URL: 
   https://my-sso-portal.awsapps.com/verify
	and enter the following code:
	QCFK-N451
        There are 3 AWS accounts available to you.
	Using the account ID 123456789012
	The only role available to you is: AWSAdministratorAccess
	Using the role name "AWSAdministratorAccess"
	CLI default client Region [None]: us-east-2
	CLI default output format [None]: json
	
	To use this profile, specify the profile name using --profile, as shown:
	
	aws s3 ls --profile labxl-devsecops 

```

Deploy stacks

```bash
$ cdk deploy --all --profile labvel-devsecops

✨  Synthesis time: 6.62s

CdkSecureIDEsVPCStack (DevVPC-CloudNativeIDEs): building assets...

[0%] start: Building 40dae843e204df8b0fc85836a8a344658c2514fa8ae825b2348df12341960f78:105171185823-us-east-1
[100%] success: Built 40dae843e204df8b0fc85836a8a344658c2514fa8ae825b2348df12341960f78:105171185823-us-east-1

CdkSecureIDEsVPCStack (DevVPC-CloudNativeIDEs): assets built

Cdkv2SecureIDEsCloud9AWSStack (CloudNativeIDEs): building assets...

[0%] start: Building 981a709b2daa7c467d8271977457844e940407809bdd5336e235c65df15d0754:105171185823-us-east-1
[0%] start: Building eb5b005c858404ea0c8f68098ed5dcdf5340e02461f149751d10f59c210d5ef8:105171185823-us-east-1
[0%] start: Building 8fbc01afe9d34b7bc70c0e0bba150b818e69346045661a6f2dde080d042234e6:105171185823-us-east-1
[0%] start: Building 496eafd105d8ed7173a71653a09e1ef0d9f49148669222520228b97
...
```
Confirm for potential sensitive changes 

```bash
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:

IAM Statement Changes
┌───┬───────────────────────────────┬────────┬──────────────────────────────────────────────────────────────┬─────────────────────────────────────┬───────────┐
│   │ Resource                      │ Effect │ Action                                                       │ Principal                           │ Condition │
├───┼───────────────────────────────┼────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────────────┼───────────┤
│ + │ ${VPC/flow_logs/IAMRole.Arn}  │ Allow  │ sts:AssumeRole                                               │ Service:vpc-flow-logs.amazonaws.com │           │
│ + │ ${VPC/flow_logs/IAMRole.Arn}  │ Allow  │ iam:PassRole                                                 │ AWS:${VPC/flow_logs/IAMRole}        │           │
├───┼───────────────────────────────┼────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────────────┼───────────┤
│ + │ ${VPC/flow_logs/LogGroup.Arn} │ Allow  │ logs:CreateLogStream                                         │ AWS:${VPC/flow_logs/IAMRole}        │           │
│   │                               │        │ logs:DescribeLogStreams                                      │                                     │           │
│   │                               │        │ logs:PutLogEvents                                            │                                     │           │
└───┴───────────────────────────────┴────────┴──────────────────────────────────────────────────────────────┴─────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Do you wish to deploy these changes (y/n)? y

```

> Deployment time is approximately 10-15 minutes due to provisioning the managed EC2 instance, disk size changes, and running custom resources.
 
Now you can see some evidence in console.



![CloudFormation Console](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t1l7ipwk7znukq2vvkc8.png)
Figure 3. CloudFormation Console.



Figure 3 shows the Stacks and nested stacks for this project. 


![Cloud9 Console.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hflgu1jcwchgn9i8jiir.png)
Figure 4. Cloud9 Console.


Figure 4 shows the cloud9 interface with environment properties according to the yaml specifications.
 


![Cloud9 Interface](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g5s6mgjowoxomcse7guh.png)
Figure 5. Cloud9 Interface.


Figure 5 shows the Cloud9 interface, here you can **share, add custom plugins, modify IDE properties**, **inspect AWS resources** and more. For example, Figure 6 shows the AWS Toolkit and some resources that you can explore without leave of the IDE.


![Cloud9 AWS Toolkit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x7zg7t2tb2dtiuwsoggi.png) 
Figure 5. Cloud9 AWS Toolkit.





### Clean up


```commandline
$ cdk destroy --all --profile labxl-devsecops
Are you sure you want to delete: Cdkv2SecureIDEsCloud9AWSStack, CdkSecureIDEsVPCStack (y/n)? y
Cdkv2SecureIDEsCloud9AWSStack (CloudNativeIDEs): destroying...
```

Enjoy and thanks for reading and sharing!