-
Notifications
You must be signed in to change notification settings - Fork 12
FAQ
For now it is focusing on DevSecOps on the CFN and Infrastructure front. Going forward, we will add tabs and subchapters. It could start with this, and then add notes on the App Development side as well. Most DevSecOps workshops are quite narrow in focus. Being part of the DevOps Immersion Day, we want to cover more content, and each customer can focus on the bits more of interest to them.
With the approach of shifting left, we are recommending IaC to be a part of Code Repository. Thus code repositories will have Application code, IaC, Configs, and act as a single source of truth. This leads us to have mechanisms in the Pipeline to ensure the CFN’s used for Deployment go through the process of linting and security checks.
That being said, we want to cover the topic broadly & highlight the different use-cases. The workshop procedure may pursue 1 approach, but theoretically, we want to mention the other approaches so that a reader gets a broad knowledge. We don’t need to boil the ocean, but list the important considerations.
We chose Wordpress just for the simplicity and general relevance. Deploying a simple 3 tier web app is something most of our customers do, and more often then not it starts with a monolith. So many of them know Wordpress, that going through that makes it quite easy to map the concepts to their own 3 tier web apps and environments. It is also a fairly small stack that makes it possible to understand everything that is going on as we gamify parts of it.
We want the pipeline to fail as fast as possible if it is to fail, so it lets us do a quick check before starting with everything else.
The goal of this workshop is to be modular. If we would like to focus on the app dev side of things, then Code Guru would be used. If we look at deploying containers, then ECR Image Scanning will be used.
For Compliance detection, we want to select 4 – 8 AWS Config “Managed Rules”. Using Managed Rules (instead of going the process of showing them how to create custom rules) allows to highlight just how many managed rules already exist and quickly incorporating them.
For Compliance notifications, we want to leverage SNS -> SQS or Email, so that participants can experience the plumbing in action.
For Compliance remediation, we can configure Config-Remediation for all (or a subset) of the Config Rules that we include.
ec2-instance-no-public-ip
ec2-instances-in-vpc
rds-instance-public-access-check
rds-snapshots-public-prohibited
codebuild-project-envvar-awscred-check
codebuild-project-source-repo-url-check
alb-http-to-https-redirection-check
vpc-default-security-group-closed
vpc-sg-open-only-to-authorized-ports
iam-policy-no-statements-with-admin-access
ebs-snapshot-public-restorable-check
s3-account-level-public-access-blocks
s3-bucket-blacklisted-actions-prohibited
s3-bucket-logging-enabled
s3-bucket-public-read-prohibited
s3-bucket-public-write-prohibited
s3-bucket-server-side-encryption-enabled
How long does the workshop take; What permissions do I need to run everything; What if I’m at an AWS event, can I run this and how; What if I need to create an account?
This module is part of an Immersion Day. Instructions will be provided on the Immersion Day Website.