newspaper_wedding/.aidlc/knowledge/aidlc-devsecops-agent/devsecops-pipeline-patterns.md

DevSecOps Pipeline Patterns

Integrating security into every stage of the CI/CD pipeline, shifting detection left and enforcing automated gates.

Shift-Left Security Principles

• Find vulnerabilities as early as possible: in the IDE, at commit time, and during CI — not after deployment.
• Make security checks fast and non-blocking in early stages (warnings), then enforcing (gates) in later stages.
• Treat security findings like bugs: track, prioritize, and fix them within normal sprint cycles.
• Security is a shared responsibility, not a gatekeeping function. Enable developers with tooling and education.

SAST — Static Application Security Testing

Purpose: Analyse source code for vulnerabilities without executing it.

Tools:

• Amazon CodeGuru Reviewer: ML-powered code review for Java and Python. Integrates with CodeCommit and GitHub.
• SonarQube / SonarCloud: Multi-language static analysis. Covers security, reliability, maintainability.
• Semgrep: Lightweight, pattern-based scanning. Fast, supports custom rules, good for enforcing team standards.
• Bandit (Python), ESLint security plugins (JavaScript/TypeScript).

Pipeline Integration:

• Run SAST on every pull request. Report findings as PR comments or annotations.
• Define severity thresholds: block merges on Critical/High findings; warn on Medium.
• Maintain a suppression file for accepted risks (with justification and expiry date).

DAST — Dynamic Application Security Testing

Purpose: Test the running application by sending crafted requests to find runtime vulnerabilities.

• Run against staging or ephemeral environments, not production.
• Tools: OWASP ZAP (open source), Burp Suite (commercial), AWS Inspector for network scanning.
• Integrate into the CD pipeline after deployment to a test environment.
• DAST complements SAST; each catches different vulnerability classes.

Dependency Vulnerability Scanning

Purpose: Detect known CVEs in third-party libraries and transitive dependencies.

Tools:

• Amazon Inspector: Scans EC2 instances, Lambda functions, and ECR images for software vulnerabilities.
• Snyk: Developer-focused, supports npm, pip, Maven, Go modules. Provides fix PRs.
• Dependabot (GitHub native): Automated dependency update PRs with vulnerability alerts.
• npm audit / pip-audit / cargo audit: Built-in language-level tools for quick local checks.

Pipeline Integration:

• Scan on every build. Fail the build on Critical/High severity CVEs with known exploits.
• Generate an SBOM (Software Bill of Materials) using Syft or Trivy for supply chain transparency.
• Review and update dependencies at least monthly; automate with Dependabot or Renovate.

IaC Security Scanning

Purpose: Detect misconfigurations in infrastructure-as-code before deployment.

Tools:

• cfn-lint: CloudFormation linter. Validates syntax and best practices.
• cfn-nag: CloudFormation static analysis. Finds overly permissive IAM policies, unencrypted resources.
• Checkov: Multi-framework scanner (CloudFormation, Terraform, CDK, Kubernetes). Policy-as-code with custom rules.
• cdk-nag: CDK-native. Checks CDK constructs against AWS Solutions rules and NIST/HIPAA packs.

Pipeline Integration:

• Run IaC scanning before cdk synth or cfn deploy. Fail the pipeline on High findings.
• Use cdk-nag as a CDK Aspect so violations are caught at synthesis time, not after.
• Maintain exception rules in code (not out-of-band) with mandatory justification comments.

Secret Detection

Purpose: Prevent credentials, API keys, and tokens from being committed to source control.

Tools:

• git-secrets (AWS Labs): Pre-commit hook that blocks patterns matching AWS credentials.
• truffleHog: Scans git history for high-entropy strings and known secret patterns.
• Gitleaks: Fast, configurable, supports CI and pre-commit. Good default ruleset.
• GitHub secret scanning: Built-in for GitHub repos; alerts on committed secrets from known providers.

Best Practices:

• Install pre-commit hooks for secret detection on every developer machine.
• Run secret scanning in CI as a backup for missed pre-commit hooks.
• If a secret is committed: revoke immediately, rotate, then clean git history.
• Store secrets in AWS Secrets Manager or SSM Parameter Store, never in code or environment files.

Container Image Scanning

Purpose: Detect OS-level and application-level vulnerabilities in container images.

• Amazon ECR image scanning: Basic (Clair-based) and Enhanced (Inspector-powered) scanning.
• Trivy: Comprehensive open-source scanner. Covers OS packages, language libraries, and IaC files.
• Scan images on push to ECR and before deployment. Block deployment of images with Critical findings.
• Use minimal base images (distroless, Alpine) to reduce attack surface.
• Rebuild and rescan images weekly to pick up newly disclosed CVEs.

Security Gates in CI/CD

Define clear pass/fail criteria at each pipeline stage:

Stage	Gate	Action on Failure
Commit	Secret detection	Block commit (pre-commit hook)
PR	SAST scan	Block merge on Critical/High
Build	Dependency scan	Fail build on Critical with exploit
Build	IaC scan	Fail build on High
Deploy to staging	DAST scan	Block promotion to production
Deploy to prod	Image scan	Block deployment on Critical
Post-deploy	Inspector continuous scan	Alert and create ticket

Automate exceptions with time-boxed waivers that require security team approval and auto-expire.