Runbook 01 Build Enterprise DevSecOps

Module: 11 – DevSecOps & Infrastructure as Code (IaC) Security

Enterprise Lab: 01

Estimated Time: 5–6 Hours

Difficulty: ⭐⭐⭐⭐⭐

Estimated Cost: AWS CodeBuild, CodePipeline, CodeDeploy, Amazon ECR, Amazon Inspector, and other CI/CD services may incur charges. Review AWS Pricing and monitor AWS Cost Explorer throughout this lab.

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, your responsibility is to design and implement a secure DevSecOps pipeline that integrates security throughout the software development lifecycle.

By completing this runbook, you will learn how to:

Configure AWS CodeCommit
Configure AWS CodeBuild
Configure AWS CodePipeline
Configure AWS CodeDeploy
Secure IAM Roles for CI/CD
Deploy Infrastructure using AWS CloudFormation
Deploy Infrastructure using Terraform
Configure AWS Secrets Manager
Configure Amazon ECR Image Scanning
Integrate Amazon Inspector
Implement Infrastructure as Code validation
Configure deployment approval gates
Validate secure application deployment

🏢 Business Scenario

CloudNova Technologies is modernising its application delivery process.

Previously, developers manually deployed infrastructure and applications directly into AWS, resulting in inconsistent deployments, exposed secrets, and security vulnerabilities.

The organisation has decided to implement a secure DevSecOps platform where infrastructure, security validation, vulnerability scanning, and deployments are fully automated.

As the Cloud Security Engineer, your responsibility is to build a secure CI/CD pipeline that prevents insecure code and infrastructure from reaching production.

📋 Prerequisites

Complete:

Module 01 – AWS Security Foundations
Module 02 – Identity & Access Management
Module 03 – AWS Organizations & Multi-Account Security
Module 04 – Amazon VPC & Network Security
Module 05 – Amazon EC2 Security
Module 06 – Data Protection & Encryption
Module 07 – Logging, Monitoring & Threat Detection
Module 08 – Network Protection
Module 09 – Vulnerability & Compliance Management
Module 10 – Backup, Disaster Recovery & Business Continuity

Required:

AWS Account
Administrator Access
Git Installed
AWS CLI
Terraform Installed
Visual Studio Code

🏗 Enterprise Architecture

Developer

      │

AWS CodeCommit

      │

AWS CodePipeline

      │

AWS CodeBuild

      │

Security Validation

├── IAM Validation
├── Terraform Validation
├── CloudFormation Validation
├── Amazon Inspector
├── Amazon ECR Image Scan
├── Secrets Validation

      │

Manual Approval

      │

AWS CodeDeploy

      │

Amazon EC2 / ECS

      │

CloudWatch

      │

Security Hub

Step 1 — Create AWS CodeCommit Repository

Navigate to:

AWS Console

↓

CodeCommit

↓

Create Repository

Repository Name

CloudNova-WebApp

Clone the repository locally.

AWS CLI

aws codecommit create-repository \
--repository-name CloudNova-WebApp

Validate:

Repository Created
Git Clone Successful

Step 2 — Configure IAM Roles

Create IAM Roles for:

CodePipeline
CodeBuild
CodeDeploy

Grant only minimum required permissions.

Review:

Least Privilege
Service Roles
Trust Relationships

AWS CLI

aws iam list-roles

Step 3 — Configure AWS CodeBuild

Navigate to:

AWS CodeBuild

↓

Create Build Project

Configure:

Source Repository
Build Environment
Build Specification
Logging

Create:

buildspec.yml

Validate:

Build Success
Logs Generated

Step 4 — Configure AWS CodePipeline

Create stages:

Source

↓

Build

↓

Security Validation

↓

Approval

↓

Deploy

Validate:

Pipeline Executes
Artifacts Created

AWS CLI

aws codepipeline list-pipelines

Step 5 — Configure AWS CodeDeploy

Create:

Deployment Application
Deployment Group

Deploy application to:

Amazon EC2

Validate:

Successful Deployment
Deployment History

Step 6 — Deploy Infrastructure using CloudFormation

Create a CloudFormation template.

Deploy:

VPC
EC2
Security Group
IAM Role

Validate:

Stack Success
Resources Created

AWS CLI

aws cloudformation list-stacks

Step 7 — Deploy Infrastructure using Terraform

Create Terraform configuration.

Deploy:

EC2 Instance
Security Group
IAM Role

Commands

terraform init

terraform validate

terraform plan

terraform apply

Validate:

Infrastructure Created
No Errors

Step 8 — Configure AWS Secrets Manager

Store:

Database Password
API Key
Application Secret

Retrieve the secret from the application.

Validate:

Secret Encryption
Access Control

AWS CLI

aws secretsmanager list-secrets

Step 9 — Configure Amazon ECR Image Scanning

Create:

ECR Repository

Push Docker image.

Enable:

Enhanced Image Scanning

Review:

Vulnerabilities
CVEs
Severity

AWS CLI

aws ecr describe-repositories

Step 10 — Configure Amazon Inspector

Enable Inspector.

Review:

EC2 Findings
Container Findings
Package Vulnerabilities

Validate:

Findings Generated

AWS CLI

aws inspector2 list-findings

Step 11 — Configure Security Gates

Add automated validation for:

Terraform Validation
CloudFormation Validation
Image Scanning
Secrets Detection
Build Success

Prevent deployment if:

Critical vulnerabilities exist
IaC validation fails
Build fails
Secrets are exposed

Step 12 — Perform Secure Deployment

Push updated application code.

Observe:

Pipeline Execution
Security Validation
Manual Approval
Deployment

Validate:

Application Running
Security Controls Passed
No Critical Findings

🧪 Enterprise Challenge

CloudNova Technologies is preparing to release a new customer-facing application.

During the deployment process the security pipeline identifies:

Hardcoded AWS Access Keys
Public Security Groups in Terraform
High-risk Docker vulnerabilities
Missing encryption configuration
Failed CloudFormation validation
IAM roles with AdministratorAccess
Failed security approval gate

As the Cloud Security Engineer, you must:

Identify each security issue
Prevent deployment
Remediate vulnerabilities
Re-run validation
Complete a successful secure deployment
Document all corrective actions
Present the deployment report to the Security Review Board

📄 Deliverables

Capture screenshots of:

CodeCommit Repository
CodePipeline
CodeBuild Logs
CodeDeploy Dashboard
CloudFormation Stack
Terraform Deployment
Secrets Manager
Amazon ECR Scan Results
Amazon Inspector Findings
Pipeline Approval Stage

Submit:

DevSecOps Architecture Diagram
Secure CI/CD Pipeline Design
Infrastructure as Code Documentation
Security Validation Report
Deployment Report
Executive Summary

🧹 Cleanup

Delete:

Test CodePipeline
Test Build Projects
Test Deployments
Temporary EC2 Instances
Test CloudFormation Stacks
Test Terraform Resources
Test Docker Images

Keep:

Architecture Documentation
Pipeline Design
Security Policies
IaC Templates
DevSecOps Documentation

Review AWS Cost Explorer and ensure no unnecessary CI/CD resources remain active.

✅ Runbook Checklist

💡 Lessons Learned

What did you learn?

Why should security be integrated into every stage of the CI/CD pipeline instead of only before production deployment?

How do CodePipeline, CodeBuild, CloudFormation, Terraform, Amazon Inspector, and Amazon ECR work together to implement DevSecOps?

Why are Infrastructure as Code validation and automated security gates essential for enterprise cloud environments?

How would you improve CloudNova Technologies’ DevSecOps pipeline for a multi-account AWS Organization?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise DevSecOps & Infrastructure as Code Security Assessment

In the next runbook, you will assess an enterprise DevSecOps environment by reviewing CI/CD pipelines, Infrastructure as Code templates, IAM permissions, secrets management, container image security, deployment controls, audit logs, and automated security gates to produce a comprehensive enterprise DevSecOps security assessment report.