Accelerating DevSecOps on AWS

Nikit Swaraj

• Publisher: Packt Publishing
• Year: 2022
• eBook ISBN: 9781803237183
• Edition: 1
• Topic: Computer Science
• Subtopic: Computer Science General
• Index: Computer Science

Build high-performance CI/CD pipelines that are powered by AWS and the most cutting-edge tools and techniquesKey Features• Master the full AWS developer toolchain for building high-performance, resilient, and powerful CI/CD pipelines• Get to grips with Chaos engineering, DevSecOps, and AIOps as applied to CI/CD• Employ the latest tools and techniques to build a CI/CD pipeline for application and infrastructureBook DescriptionContinuous integration and continuous delivery (CI/CD) has never been simple, but these days the landscape is more bewildering than ever; its terrain riddled with blind alleys and pitfalls that seem almost designed to trap the less-experienced developer. If you're determined enough to keep your balance on the cutting edge, this book will help you navigate the landscape with ease.This book will guide you through the most modern ways of building CI/CD pipelines with AWS, taking you step-by-step from the basics right through to the most advanced topics in this domain.The book starts by covering the basics of CI/CD with AWS. Once you're well-versed with tools such as AWS Codestar, Proton, CodeGuru, App Mesh, SecurityHub, and CloudFormation, you'll focus on chaos engineering, the latest trend in testing the fault tolerance of your system. Next, you'll explore the advanced concepts of AIOps and DevSecOps, two highly sought-after skill sets for securing and optimizing your CI/CD systems. All along, you'll cover the full range of AWS CI/CD features, gaining real-world expertise.By the end of this AWS book, you'll have the confidence you need to create resilient, secure, and performant CI/CD pipelines using the best techniques and technologies that AWS has to offer.What you will learn• Use AWS Codestar to design and implement a full branching strategy• Enforce Policy as Code using CloudFormation Guard and HashiCorp Sentinel• Master app and infrastructure deployment at scale using AWS Proton and review app code using CodeGuru• Deploy and manage production-grade clusters using AWS EKS, App Mesh, and X-Ray• Harness AWS Fault Injection Simulator to test the resiliency of your app• Wield the full arsenal of AWS Security Hub and Systems Manager for infrastructure security automation• Enhance CI/CD pipelines with the AI-powered DevOps Guru serviceWho this book is forThis book is for DevOps engineers, engineering managers, cloud developers, and cloud architects. Basic experience with the software development life cycle, DevOps, and AWS is all you need to get started.

Section 1:Basic CI/CD and Policy as Code

This part includes chapters that cover how to create a CI/CD pipeline using AWS CodeStar with a branching strategy and adding multiple stages and environments. It covers how to leverage the AWS Proton service to create a CI/CD pipeline for applications and infrastructure at scale. It also covers how to avoid any secrets and vulnerabilities in code by integrating AWS CodeGuru Reviewer with CodeCommit. After that, it covers how to enforce policy on infrastructure code using CloudFormation Guard and HashiCorp Sentinel.

This section contains the following chapters:

• Chapter 1, CI/CD Using AWS CodeStar
• Chapter 2, Enforcing Policy as Code on CloudFormation and Terraform
• Chapter 3, CI/CD Using AWS Proton and an Introduction to AWS CodeGuru

Chapter 1: CI/CD Using AWS CodeStar

This chapter will first introduce you to the basic concepts of Continuous Integration/Continuous Deployment (or Continuous Delivery) (CI/CD) and a branching strategy. Then, we will implement basic CI/CD for a sample Node.js application using Amazon Web Services (AWS) CodeStar, which will deploy the application in Elastic Beanstalk. We will begin by creating a CodeStar project, then we will enhance it by adding develop and feature branches in a CodeCommit repository. We will also add a manual approval process as well as a production stage in CodePipeline. We will also spin up the production environment (modifying a CloudFormation template) so that the production stage of the pipeline can deploy the application. After that, we will create two lambda functions that will validate the Pull Request (PR) raised from the feature branch to develop branch, by getting the status of the CodeBuild project. Doing this entire activity will give you an overall idea of AWS Developer Tools (CodeCommit, CodeBuild, and CodePipeline) and how to implement a cloud-native CI/CD pipeline.

In this chapter, we are going to cover the following main topics:

• Introduction to CI/CD, along with a branching strategy
• Creating a project in AWS CodeStar
• Creating feature and development branches, as well as an environment
• Validating PRs/Merge Requests (MRs) into the develop branch from the feature branch via CodeBuild and AWS Lambda
• Adding a production stage and environment

Technical requirements

To get started, you will need an AWS account and the source code of this repository, which can be found at https://github.com/PacktPublishing/Accelerating-DevSecOps-on-AWS/tree/main/chapter-01.

Introduction to CI/CD, along with a branching strategy

In this section of the chapter, we will dig into what exactly CI/CD is and why is it so important in the software life cycle. Then, we will learn about a branching strategy, and how we use it in the source code repository to make the software delivery more efficient, collaborative, and faster.

CI

Before getting to know about CI, let's have a brief look at what happens in a software development workflow. Suppose you are working independently, and you have been asked to develop a web application that is a chat system. So, the first thing you will be doing is to create a Git repository and write your code in your local machine, build the code, and run some tests. If it works fine in your local environment, you will then push it to a remote Git repository. After that, you will build this code for different environments (where the actual application will run) and put the artifact in the artifact registry. After that, you will deploy that artifact into the application server where your application will be running.

Now, suppose the frontend of your application is not too good, and you want some help from your frontend developer. The frontend developer will clone the code repository, then contribute to the repository either by modifying the existing code or adding new code. After that, they will commit the code and push it into the repository. Then again, the same steps of build and deploy will take place, and your application will be running with the new User Interface (UI). Now, what if you and the frontend developer both want to enhance the application, whereby both of you will be writing the code, and somehow you both used the same file and did your own changes, and tried to push back to the repository? If there are no conflicts, then your Git repository will allow you to update the repository, but in case there are any conflicts then it will highligh...

Table of contents

• Accelerating DevSecOps on AWS
• Contributors
• Preface
• Section 1:Basic CI/CD and Policy as Code
• Chapter 1: CI/CD Using AWS CodeStar
• Chapter 2: Enforcing Policy as Code on CloudFormation and Terraform
• Chapter 3: CI/CD Using AWS Proton and an Introduction to AWS CodeGuru
• Section 2:Chaos Engineering and EKS Clusters
• Chapter 4: Working with AWS EKS and App Mesh
• Chapter 5: Securing Private EKS Cluster for Production
• Chapter 6: Chaos Engineering with AWS Fault Injection Simulator
• Section 3:DevSecOps and AIOps
• Chapter 7: Infrastructure Security Automation Using Security Hub and Systems Manager
• Chapter 8: DevSecOps Using AWS Native Services
• Chapter 9: DevSecOps Pipeline with AWS Services and Tools Popular Industry-Wide
• Chapter 10: AIOps with Amazon DevOps Guru and Systems Manager OpsCenter
• Other Books You May Enjoy