Runbook 02 Enterprise DevSecOps

Module: 11 – DevSecOps & Infrastructure as Code (IaC) Security

Enterprise Lab: 02

Estimated Time: 4–5 Hours

Difficulty: ⭐⭐⭐⭐⭐

Estimated Cost: Free Tier (No additional AWS charges)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, you have been assigned to perform a comprehensive security assessment of the organization’s DevSecOps platform and Infrastructure as Code (IaC) deployment process.

Your objective is to evaluate the security posture of the CI/CD pipeline, identify risks within Infrastructure as Code templates, verify security controls, assess secrets management, review deployment processes, and provide recommendations before production releases.

By completing this runbook, you will learn how to:

Review AWS CodeCommit Security
Review AWS CodeBuild Configuration
Review AWS CodePipeline
Review AWS CodeDeploy
Review IAM Roles & Permissions
Review CloudFormation Templates
Review Terraform Configuration
Review AWS Secrets Manager
Review Amazon ECR Image Scanning
Review Amazon Inspector Findings
Review CI/CD Audit Logs
Review Deployment Approvals
Identify DevSecOps Security Risks
Develop Remediation Plans
Produce an Executive DevSecOps Security Assessment Report

🏢 Business Scenario

CloudNova Technologies has adopted a fully automated DevSecOps model for deploying applications and cloud infrastructure.

Before the next production release, the Chief Information Security Officer (CISO) has requested an independent security assessment of the CI/CD platform to ensure that insecure code, vulnerable infrastructure, exposed secrets, and excessive permissions cannot reach production.

As the Cloud Security Engineer, your responsibility is to evaluate the DevSecOps environment and certify its readiness for enterprise deployment.

📋 Prerequisites

Complete:

Enterprise Runbook 01 — Build Enterprise DevSecOps & Infrastructure as Code Security

Required:

AWS Account
Administrator Access
Git Installed
AWS CLI
Terraform Installed
Visual Studio Code

🏗 Existing Enterprise Architecture

Developer

      │

AWS CodeCommit

      │

AWS CodePipeline

      │

AWS CodeBuild

      │

Security Validation

├── IAM Policy Review
├── Terraform Validation
├── CloudFormation Validation
├── Secrets Detection
├── Amazon Inspector
├── Amazon ECR Image Scanning

      │

Approval Stage

      │

AWS CodeDeploy

      │

Amazon EC2 / ECS

      │

CloudWatch Logs

      │

Security Hub

Your objective is to determine whether the DevSecOps platform complies with enterprise security best practices.

Step 1 — Review AWS CodeCommit

Navigate to:

AWS Console

↓

CodeCommit

↓

Repositories

Review:

Repository Permissions
Branch Protection Strategy
IAM Access
Repository Encryption
Commit History

Questions:

Who can push directly to the main branch?
Are repositories encrypted?
Are branch protection controls implemented?

AWS CLI

aws codecommit list-repositories

Step 2 — Review IAM Roles

Review CI/CD IAM Roles:

CodePipeline Role
CodeBuild Role
CodeDeploy Role
CloudFormation Role

Review:

Least Privilege
AdministratorAccess Usage
Trust Relationships
Inline Policies

Questions:

Are permissions excessive?
Are service roles restricted?

AWS CLI

aws iam list-roles

Step 3 — Review AWS CodeBuild

Navigate to:

AWS CodeBuild

↓

Build Projects

Review:

Build Environment
Build Logs
Environment Variables
IAM Role
buildspec.yml

Questions:

Are secrets stored securely?
Are build logs retained?
Is privileged mode enabled unnecessarily?

AWS CLI

aws codebuild list-projects

Step 4 — Review AWS CodePipeline

Navigate to:

AWS CodePipeline

↓

Pipelines

Review:

Source Stage
Build Stage
Security Validation Stage
Approval Stage
Deployment Stage

Questions:

Are manual approvals required?
Are failed security checks blocking deployment?
Is pipeline encryption enabled?

AWS CLI

aws codepipeline list-pipelines

Step 5 — Review AWS CodeDeploy

Review:

Deployment Groups
Deployment Strategy
Rollback Configuration
Deployment History

Questions:

Is automatic rollback enabled?
Are deployments monitored?

AWS CLI

aws deploy list-applications

Step 6 — Review CloudFormation Templates

Review:

Security Groups
IAM Policies
Encryption Settings
Public Resources
Parameter Validation

Questions:

Are resources encrypted?
Are public Security Groups prevented?
Are templates reusable?

AWS CLI

aws cloudformation list-stacks

Step 7 — Review Terraform Configuration

Review:

Terraform State
Variables
Providers
Modules
Outputs

Validate:

terraform validate

terraform plan

Questions:

Are sensitive values exposed?
Are security controls implemented?

Step 8 — Review AWS Secrets Manager

Navigate to:

AWS Secrets Manager

Review:

Secrets
Rotation
IAM Access
Encryption
Secret Policies

Questions:

Are secrets rotated?
Are secrets hardcoded elsewhere?

AWS CLI

aws secretsmanager list-secrets

Step 9 — Review Amazon ECR Image Scanning

Review:

Container Repositories
Scan Results
Critical Vulnerabilities
High Vulnerabilities

Questions:

Are images scanned automatically?
Are vulnerable images deployed?

AWS CLI

aws ecr describe-repositories

Step 10 — Review Amazon Inspector

Review:

EC2 Findings
Container Findings
Package Vulnerabilities
Severity Distribution

Questions:

Are critical findings resolved?
Are Inspector scans scheduled?

AWS CLI

aws inspector2 list-findings

Step 11 — Review Audit Logs

Review:

CloudTrail
CodePipeline History
CodeBuild Logs
Deployment Logs
CloudWatch Logs

Questions:

Are all deployments auditable?
Are failed deployments investigated?

Step 12 — Review Security Gates

Review pipeline controls for:

Terraform Validation
CloudFormation Validation
Secrets Detection
Image Scanning
Manual Approval
Policy Enforcement

Questions:

Can insecure code bypass approvals?
Are security gates mandatory?

Step 13 — Identify Security Findings

Document findings.

Finding	Risk	Severity	Recommendation
AdministratorAccess assigned to CodeBuild	High	Critical	Implement least privilege IAM roles
Secrets stored in buildspec.yml	High	Critical	Use AWS Secrets Manager
Manual approval disabled	Medium	High	Enable approval before production deployment
Container image contains critical CVEs	High	Critical	Block deployment until remediated
CloudFormation deploys public Security Groups	High	High	Restrict inbound access
Terraform validation not enforced	Medium	High	Add validation stage to pipeline
No rollback strategy configured	Medium	Medium	Enable automatic deployment rollback

Step 14 — Develop Remediation Plan

Immediate (Within 24 Hours)

Remove excessive IAM permissions
Remove hardcoded secrets
Block vulnerable container images
Enable deployment approvals
Fix insecure IaC templates

Short-Term (30 Days)

Implement automated IaC scanning
Standardise IAM policies
Enable automated secret rotation
Integrate additional security testing
Improve deployment logging

Long-Term (90 Days)

Multi-account DevSecOps governance
Policy-as-Code implementation
Automated compliance validation
Continuous pipeline monitoring
Centralised security dashboards

Step 15 — Validation

Verify:

CodeCommit reviewed
IAM roles reviewed
CodeBuild reviewed
CodePipeline reviewed
CodeDeploy reviewed
CloudFormation templates reviewed
Terraform configuration reviewed
Secrets Manager reviewed
Amazon ECR reviewed
Amazon Inspector reviewed
Audit logs reviewed
Security gates reviewed
Risks documented
Remediation roadmap completed

🧪 Enterprise Challenge

CloudNova Technologies is preparing to release a new production application.

The security assessment identifies:

Hardcoded AWS Access Keys committed to Git
Terraform configuration exposing port 22 to the Internet
CloudFormation templates missing encryption
CodeBuild role assigned AdministratorAccess
Critical vulnerabilities detected in Docker images
Secrets stored as plaintext environment variables
Manual approval stage removed from the production pipeline
CloudTrail logging disabled for deployment activities

As the Cloud Security Engineer, you must:

Assess the security posture of the DevSecOps platform
Identify all security risks
Prioritise findings based on business impact
Recommend remediation actions
Validate secure deployment controls
Produce an executive DevSecOps assessment report
Present recommendations to the Security Review Board

📄 Deliverables

Capture screenshots of:

CodeCommit Repository
IAM Roles
CodeBuild Configuration
CodePipeline Stages
CodeDeploy Dashboard
CloudFormation Stack
Terraform Validation
AWS Secrets Manager
Amazon ECR Scan Results
Amazon Inspector Findings
CloudTrail Logs
Pipeline Approval Stage

Submit:

Enterprise DevSecOps Security Assessment Report
CI/CD Risk Register
Infrastructure as Code Security Review
Remediation Roadmap
Executive Summary
Secure Deployment Recommendations

🧹 Cleanup

This is primarily an assessment runbook.

Do NOT delete:

CodeCommit Repositories
CodePipeline
CodeBuild Projects
CodeDeploy Applications
CloudFormation Templates
Terraform Code
Secrets Manager Secrets
Amazon ECR Repositories
Amazon Inspector Configuration

Delete only:

Temporary test pipelines
Test deployment resources
Experimental build projects
Temporary EC2 instances
Test Docker images

✅ Runbook Checklist

💡 Lessons Learned

What DevSecOps security weaknesses were identified?

Why should security controls be integrated into every stage of the CI/CD pipeline rather than only before production deployment?

How do AWS CodePipeline, CloudFormation, Terraform, Amazon Inspector, and Amazon ECR work together to create a secure software delivery lifecycle?

Why are automated security gates and least-privilege IAM permissions critical for enterprise DevSecOps?

How would you improve CloudNova Technologies’ DevSecOps platform for a multi-account AWS Organization with hundreds of developers?

🚀 Next Module

12 — AWS Security Architecture

In the next module, you will design secure, scalable, and resilient AWS environments by applying the AWS Well-Architected Framework, Security Reference Architecture (SRA), Landing Zone, Multi-Account Design, Zero Trust, Identity Federation, Network Segmentation, and defence-in-depth principles to build enterprise-grade cloud security architectures.