E-BOOK

A complete guide to
Implementing
DevSecOps in AWS

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 1

E-BOOK

Table of contents

1. Chapter 1 Introduction 3

2. Chapter 2 Big 5 Reasons to Opt DevOps 4

3. Chapter 3 What is DevSecOps? 6

4. Chapter 4 AWS CI/CD and Support Tools 9

5. Chapter 5 Open Source/AWS Continuous Testing Tools 10

6. Chapter 6 AWS Security, Identity, and Compliance Service 11

7. Chapter 7 DevSecOps Reference Architecture 12

8. Chapter 8 Conclusion 14

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 2

E-BOOK

Chapter 1

Chapter 2

Chapter 3
Chapter 1 Chapter 4

Chapter 5
Introduction
Chapter 6

Chapter 7

Chapter 8

With the business landscape evolving every passing due to the slow and vulnerable nature.
day, organizations are expected to stay at the cutting
edge to pacify their customers. Today, the first DevOps is a popular approach that makes
aspect that a customer looks for in an organization’s cybersecurity vigilance a reality by embedding
product or service offerings is the software – either the right tools into your software development
the mobile applications or the official website of lifecycle. In this eBook, we explain why and how
the company. Businesses have realized that to implementing DevOps into your existing AWS
hold the silver spoon against their competitors, Cloud applications is paramount for your business.
they need to keep reinventing their products or
services and always be the first candidate to enter
the market with a new set of offerings. This has
led to a faster evolution of software development
methodologies including Lean, Agile, DevOps etc.
to meet these requirements. In order to improve
quality, businesses are focused on the user needs
early in the project, involve development and
operations gradually, and break the project into
smaller pieces to allow for frequent testing. The
abundance of infrastructure-as-a-service (IaaS)
offerings has been an instrumental catalyst in this
transformation.

There is also a flip side to this. As businesses

start focusing on going digital, the software
applications and data are vulnerable to hackers
and cybercrimes. The efforts by businesses to
move to a secure development cycle have been
focused on the traditional methods of security – the
waterfall model. While DevOps comes to the fore,
traditional security approaches are being discarded

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 3

E-BOOK

Chapter 1

Chapter 2

Chapter 3
Chapter 2 Chapter 4

Chapter 5
Big 5 Reasons to Opt DevOps
Chapter 6

Chapter 7

Chapter 8

With cloud taking the helm in today’s scenario, business targets.

businesses need to have a robust security plan.
However, most of them don’t have the time or A global geolocation company achieved 30%
resources to have a dedicated team that does reduction in deployment time, 30% reduction
everything from the scratch. Instead, businesses in infrastructure costs, and 30-40% less time
can start by securing applications based on the risk in CI/CD pipeline.
levels. More often than not, organizations begin
with securing the service or applications they know 2. Higher customer satisfaction
is the right fit or try risking with multiple, expensive
security appliances. As you may imagine, DevOps brings a multitude
of business benefits to organizations. By providing
While the IT teams are engrossed in transitioning end-users with high quality software and excellent
core services, security becomes the least priority. experience, DevOps helps create a strong
Also, some businesses are still confused about relationship with customers and providing them
where the CSP’s responsibility ends and the with more reliable applications, faster. DevOps
customer’s responsibility begins, or what is the also helps the IT teams in discovering issues
best way to secure their services and products. earlier and thus prevent bugs from passing
through the development stage and appearing in
DevOps contributes to both software development the final output.
teams and the customers, saving organizations
a large chunk of money and resources. We have 3. Better Collaboration
listed 5 reasons why:
The introduction of DevOps brings about some
1. Innovation serious cultural changes within the organization.
The increased communication and collaboration
One of the key benefits of the DevOps model is between the internal teams in an organization
its high velocity. Organizations are able to remain means the process becomes transparent with
at the cutting edge by being able to adapt to the open lines of communication – sharing knowledge
fluctuating market requirements, innovate faster, and best practices to build a successful process.
and become more efficient in achieving their

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 4

E-BOOK

4. Increased flexibility DevOps promises shorter development cycle time

by increasing the frequency of releasing code into
As mentioned earlier, with the advent of DevOps, production.
organizations have found a way to adapt to the
fluctuating market standards. The IT teams have A State of DevOps report from 2019 found that
been able to optimize their time and resources teams that have implemented DevOps deploy
based on the customer requirements. 208 times more frequently and 106 times faster
than other organizations.
5. Faster time to market

Through better collaboration between the teams,

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 5

E-BOOK

Chapter 1

Chapter 2

Chapter 3
Chapter 3 Chapter 4

Chapter 5
What is DevSecOps?
Chapter 6

Chapter 7

Chapter 8

DevOps allows companies to deliver new DevSecOps implements continuous and

application features and innovative services to automated security mechanisms during the
customers at a faster pace. DevSecOps takes infancy stages of software development and
this one step further by integrating security into warrants security throughout the cycle.
the mix. By leveraging DevSecOps, organizations
can deliver secure applications at will while the Integrating security into your IT teams will help you
automation takes care of the operations. achieve the following:

Reduced costs:
Early bug fixes
Improved software
security:
stringent security measures
Higher customer along the pipeline
value

Increased
Reduced time for recovery speed:
security checks: due to early threat
automated cybersecurity detections

Faster deliveries: Enhanced threat hunting:

traditional security procedures are credit to continuous threat
no longer functional monitoring

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 6

E-BOOK

Implementing an end-to-end DevSecOps pipeline smaller pieces, identifying the vulnerabilities in the
is critical to building a successful software initial stages of the development process will help
delivery, which includes continuous integration reduce costs and the automation aspect of the
(CI), continuous delivery and development (CD), process will accelerate the delivery as well.
continuous testing, logging and monitoring, auditing
and governance, and operations. As DevSecOps The below infographic shows the process carried
breaks down the software development cycle into out during the development phase of DevSecOps
security controls.

Secure
Secure by CI Server
Code Security Tests
Design deploys to
Training
Test DAST perform app
Gather threat and
Engineers gain specific automated
abuse case models Automated
awareness of security testing and
and security deployment via IaC
AppSec dynamic container
requirements. Adapt
principles and analysis. Validate
reusable secure by-
responsibilities controls are
default design patterns
mitigating the abuse
case threat sectors

Composition
Pre-commit Security
Analysis
configurations Review
for secret Analyze third (Human Logic
scanning Secure party/open source Test)
access to app, libraries. Reuse
code & Image secure code only Conduct
repository and comply with penetration testing
OSS licensing where it makes
Implement least sense.( Might not
privilege RBAC and be needed for every
new solution to code sprint)
and private container
repository IaC version
controlled

Secure Access Image

Code Analysis
to CI Service Assurance
SAST analysis
Prevent unauthorized Validate image
code for
manipulation of the integrity signatures
vulnerabilities IDE
pipeline itself with and that assurance
and build server
RBAC and separation polices are yet to
integrated with
of duties proceed to prod
remediation advice

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 7

E-BOOK

As we move to the production phase, here are a few things that the development teams must keep in mind:

Application and Deploy to

Rinse and Repeat
Infrastructure Production
Hardening Improve and enforce
Automated Deployments by
governance
• Protect and monitor the IaC compliance and security
app and cluster using testing
RASP/WAF and
container sand-boxing Vulnerability
• Apply infrastructure Scanning
hardening, data
Ensure continuous
encryption endpoint
assessment and automated
protection, DLP and IPS
OS benchmarking of build
Privileged access, and deployed images and
environments
secrets management
& network isolation
Continuous
• Implement tight monitoring & Incident
network & access Response
policy by looking down
Analyze intrusion/breach
clusters/pods, VM’s
alerts and threat intelligence
• Use secrets
log attacks, behaviors and
management and
threats to respond, learn
automated certificate
from and apply to next sprint
handling

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 8

E-BOOK

Chapter 1

Chapter 2

Chapter 3
Chapter 4 Chapter 4

Chapter 5
AWS CI/CD and Support Tools
Chapter 6

Chapter 7

Chapter 8

In this chapter, we discuss the various AWS services and third-party support tools used in this solution.

As far as CI/CD is concerned, we leverage the following AWS services.

AWS A fully managed continuous integration service that compiles source code, runs
CodeBuild tests, and produces software packages that are ready to deploy.

AWS Code
A fully managed source control service that hosts secure Git-based repositories.
Commit

A fully managed deployment service that automates software deployments to a

AWS Code variety of compute services such as Amazon Elastic Compute Cloud (Amazon
Deploy EC2), AWS Fargate, AWS Lambda, and your on-premises servers.

AWS Code A fully managed continuous delivery service that helps you automate your
Pipeline release pipelines for fast and reliable application and infrastructure updates.

AWS A service that lets you run code without provisioning or managing servers. You
Lambda pay only for the compute time you consume.

Amazon Simple Amazon SNS is a fully managed messaging service for both application-to-
Notification application (A2A) and application-to-person (A2P) communication.
Service

Amazon Amazon S3 is storage for the internet. You can use Amazon S3 to store and
S3 retrieve any amount of data at any time, from anywhere on the web.

AWS Systems Parameter Store provides secure, hierarchical storage for configuration data
Manager management and secrets management.
Parameter Store

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 9

E-BOOK

Chapter 1

Chapter 2

Chapter 5 Chapter 3

Chapter 4

Open Source/AWS Chapter 5

Continuous Testing Tools Chapter 6

Chapter 7

Chapter 8

Listed below is the open-source scanning tools available in AWS that are integrated in the pipeline. You could
also opt for different tools based on your business requirements. For example, most businesses use the static
code review tool Amazon CodeGuru for static analysis.

Amazon Elastic Container Git-Secrets (Secrets

Amazon CodeGuru
Registry image scanning Scanning)

Amazon ECR image scanning

helps in identifying software
vulnerabilities in your container
Prevents you from committing
images. Amazon ECR uses the
sensitive information to Git
For static analysis Common Vulnerabilities and
repositories. It is an open-
Exposures (CVEs) database
source tool from AWS Labs.
from the open-source Clair
project and provides a list of
scan findings.

OWASP ZAP (DAST) Anchore (SCA and SAST) Sysdig Falco (RASP)

Falco is an open source

Anchore Engine is an
cloud-native runtime security
Helps you automatically find open-source software system
project that detects unexpected
security vulnerabilities in your that provides a centralized
application behavior and alerts
web applications while you’re service for analyzing container
on threats at runtime. It is the
developing and testing your images, scanning for security
first runtime security project to
applications. vulnerabilities, and enforcing
join CNCF as an incubation-
deployment policies.
level project.

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 10

E-BOOK

Chapter 1

Chapter 2

Chapter 6 Chapter 3

Chapter 4

AWS Security, Identity, and Chapter 5

Compliance Service Chapter 6

Chapter 7

Chapter 8

AWS’ security, identity, and compliance services are categorized based on 4 function types:

Authorization Protected Store Visibility Enforcement

Each of these functions has at least 2-3 AWS tools that may suit your business requirements.

Authorization

IAM AWS RAM AWS Organizations

Protected Store Visibility

AWS AWS AWS AWS AWS AWS Security

CloudHSM KMS Secrets Certificate Artifact Hub
Manager Manager

Enforcement

Amazon Amazon Amazon AWS AWS

GuardDuty Inspector Macie WAF Shield

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 11

E-BOOK

Chapter 1

Chapter 2

Chapter 7 Chapter 3

Chapter 4

DevSecOps Reference Chapter 5

Architecture Chapter 6

Chapter 7

Chapter 8

The following diagram represents the DevSecOps reference architecture on AWS that covers the aforementioned
practices, services, and support tools.

Build
Test (Secrets) Test (SCA, SAST) Deploy Test (DAST) Deploy (PRD)

Deploy

CodeCommit CodeBuild CodeBuild CodeBuild CodeBuild CodeBuild

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 12

E-BOOK

Listed below is the chronological sequence of 10. During the pipeline run, CloudWatch Events
events that are carried out on your AWS cloud. records the build state changes and sends
out email notifications to all the subscribers
1. When a user writes the code to a CodeCommit through SNS notifications.
repository, a CloudWatch event is generated,
triggering a CodePipeline. 11. CloudTrail tracks the API calls and sends
notifications on critical events happening on
2. CodeBuild packages it and sends the artifacts the pipeline.
to an S3 bucket. It retrieves the authentication
data from the Parameter Store to kickstart the 12. Finally, AWS Config keeps track of all the
scanning. As a best practice, we advise you configuration changes of AWS services.
to use AWS CodeArtifact to store the artifacts.
Security in the pipeline is implemented by using
3. While CodeBuild scans the code with an SCA IAM roles and S3 bucket policies with SCA, SAST,
tool (OWASP Dependency-Check) and SAST and DAST security checks.
tool, you can pick one of these during the
deployment. As a best practice, encryptions must be enabled
for code and artifacts, irrespective of whether at
4. If there are any vulnerabilities found from these rest or transit.
tools, CodeBuild invokes the Lambda function.
The Lambda function converts the results into
AWS Security Finding Format (ASFF) and
posts them on Security Hub. Security Hub
aggregates the findings in a single repository
and the Lambda function also uploads the
same into an S3 bucket.

5. CodeDeploy deploys the code to the

Elastic Beanstalk environment in case of no
vulnerabilities.

6. Once the deployment succeeds, CodeBuild

triggers the DAST scanning with the OWASP
ZAP tool.

7. If there are any vulnerabilities, step 4 is

followed again.

8. In case of no vulnerabilities, the approval

stage is ready and an email is dispatched to
the approver for action.

9. Once approved, CodeDeploy deploys the code

to the Beanstalk environment.

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 13

E-BOOK

Chapter 1

Chapter 2

Chapter 3
Chapter 8 Chapter 4

Chapter 5
Conclusion
Chapter 6

Chapter 7

Chapter 8

DevOps is a commendable approach if you are cyber-attacks and ticket resolutions when you
looking to improve software engineering and have DevSecOps in the fore?
maintenance processes. However, companies can
only achieve maximum advantage if security is Schedule a free consultation with our experts to
integrated into your DevOps practices. get started.

Organizations that have implemented DevSecOps Watch our latest webinar to know how integrating
have enjoyed enhanced automation throughout security into your DevOps framework tightens
the software delivery pipeline, thereby eliminating your AWS Cloud security. Adopting DevSecOps
cyber-attacks and ensuring pro-active security. will help your security teams focus on other value-
added activities.
So, why engross your cloud security teams with

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 14

E-BOOK

About
Aspire Systems

• Global technology services firm with core DNA • Well Rounded Team covering Cloud Architects,
of Software Engineering Solution Experts & Application
• Specific areas of expertise around Software • Consultants
Engineering, Digital Services, • CMMI Maturity Level 3, ISO 9001:2015, and
• Testing, and Infrastructure & Application ISO 27001: 2013 certified
Support • International headquarters in Singapore with
• The vertical focus among Independent presence across US, Mexico, UK,
Software Vendors, Retail, Distribution & • The Netherlands, Poland, Middle East, and
• Consumer Products and BFSI India
• 3000+ employees; 150+ active customers • Recognized 11 consecutive times as “Best
• Oracle Global Platinum Partnership with OCI & Place to Work for” by GPW Institute
R12.2.9, Domain Expertise

Contact Us
For more info contact: [email protected] or visit www.aspiresys.com

NORTH AMERICA POLAND INDIA MIDDLE EAST

+1 630 368 0970 +48 58 732 77 71 +91 44 6740 4000 +971 50 658 8831

NETHERLANDS UNITED KINGDOM SINGAPORE MEXICO

+31 (0)30 800 92 16 +44 203 170 6115 +65 3163 3050 +52 222 980 0115

A COMPLETE GUIDE TO IMPLEMENTING DEVSECOPS IN AWS 15