DevSecOps in AWS Codepipeline
Tags: aws, awscommunitybuilder, devsecops, awscodepipeline
Published: 2022-04-25 17:08:53


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e83l8s715mrjjdcmrdqo.jpg)

**Introduction**
Traditional security cannot keep pace with DevOps’s lightning-fast software development cycles. Organisations need to inject continuous security and automated testing throughout the software development process to improve security. Secure DevOps—that is, DevSecOps—is about making security central to development and operations. Building security into every stage of the software pipeline fills long-standing gaps between IT and Security. DevSecOps approach helps spot software security issues faster and alleviates security bottlenecks. And, it preserves the rapid development pace that DevOps makes possible. This post will show you how to do implement DevSecOps CI/CD using AWS CodePipeline.

**Before DevSecOps**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iy8fm288ynd93el3iuky.jpg)

Above is normal Angular website which the flow like below:

1. Developer/Programmer wil commit the new updated code to **AWS CodeCommit** Repository.
2. **AWS CodePipeline **automatic triggered from the CodeCommit updated code in **SOURCE stage** below:
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ta5hq2nv3v33sfbftdbh.png) 
3. Then it's goes to **BUILD stage** started the **Unit-Test** action group using "ng-test" command from "unit-test-buildspec.yml" file we set.
4. Then it goes to Build process by using "ng-build" via buildspec.yml file we set.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ajojumfisceemgetydp8.png)
5. We have dynamic Staging EC2 server by using AWS CloudFormation which we only provision Staging server whenever we have new updated code.
6. Once we provisioned Staging server then we deploy to EC2 server. We also passed CodeDeploy parameter which new Staging URL for manual approval or reviewer to evaluate our staging environment/server.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/txc8nubogjuk24s7fmor.png)
 
Here our Staging look like: 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o5h1rcek0kwnqkqrvdra.png)
 
7. Once the Approver approved and reviewed our Staging environment, we will delete our Staging CloudFormation Stack.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j8oz548nys4zol7s35q7.png)
8. Lastly, we deploy to Production environment which we using AWS CodeDeploy 
 ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/51t3nhygv1roq8lwixra.png)
 
**From DevOps to DevSecOps **
Now we can introduce the DevSecOps tools to use "Shift-Left" approach which added security scanner in BUILD, STAGING and PRD stage like below.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m9md7vgejc0jmbjt98s4.jpg)

**DevSecOps Toolchain**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u3xmy17twxp2o8jlwq0b.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7n0cgz1p9ubwb9en1k5s.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kl3rh3imo6xynelkwe65.png)
  
 **How to optimize your DevSecOps Pipeline**

1. Everyone should understand failures quickly

- CI job output with key messages
- Use colored error messages with emojis ✅ 
- Hint and link troubleshooting docs

2. Always use exactly the same environment
- A CI/CD pipeline can’t be reliable if a pipeline run modifies the next pipeline’s environment. 
- Each workflow should start from the same, clean, and isolated environment.

3. Document the pipeline design
- In your repository use Markdown docs to describe what you do on your CI/CD pipeline.
- You also can use Wiki Page or Confluence to make everyone in the team know better about CI/CD process.

4. Communication
- Human communication, collaboration, and teamwork are examples of factors that do not rely on automation. 
- In the absence of these three factors, success will be extremely hard to achieve. 
- It's crucial to optimize communication and transparency in your CI/CD pipeline workflow if you want it to succeed.

**Conclusion**

- Shift-Left + DevSecOps
I think that everyone in the organization must make an effort to "Shift-Left" to a DevSecOps culture or methodologies and come up with a multidisciplinary security team. 
- Agile +  DevSecOps
DevSecOps must be fed by Agile software development. Security user stories must be part of each sprint. 
- Automation is the key
Security and test automation can reduce delivery time, improve quality and security, and eliminate human error