aws-samples / devsecops-cicd Goto Github PK

License: MIT No Attribution

Python 22.82% Ruby 0.20% Java 33.38% HTML 43.34% Procfile 0.27%

devsecops-cicd's Introduction

AWS DevSecOps Pipeline

DevSecOps pipeline using AWS cloud native services and open source security vulnerability scanning tools.

This DevSecOps pipeline uses AWS DevOps tools CodeBuild, AWS CodeCommit, AWS CodeDeploy, and AWS CodePipeline along with other AWS services. It is highly recommended to fully test the pipeline in lower environments and adjust as needed before deploying to production.

Build and Test:

AWS Buildspec and property files for security vulnerability scanning:

buildspec-owasp-depedency-check.yml: buildspec file to perform SCA analysis using OWASP Dependency-Check.
buildspec-sonarqube.yml: buildspec file to perform SAST analysis using SonarQube.
buildspec-phpstan.yml: buildspec file to perform SAST analysis using PHPStan. This opensource tool is only applicable for scanning PHP application.
buildspec-owasp-zap.yml: buildspec file to perform DAST analysis using OWASP Zap.
Composer.json: PHP package manager for installing PHPStan and dependencies.
phpstan.neon: configuration file for PHPStan.
Sonar-project.properties: SonarQube configuration file.

Lambda files:

AWS lambda is used to parse the security scanning results and post them to AWS Security Hub

import_findings_security_hub.py: to parse the scanning results and extract the vulnerability details.
securityhub.py: to post the vulnerability details to AWS Security Hub in ASFF format (AWS Security Finding Format).

CloudFormation for Pipeline:

codepipeline-template.yml: CloudFormation template to deploy DevSecOps CICD Pipeline

Deploying pipeline:

Download the CloudFormation template and pipeline code from GitHub repo.

Log in to your AWS account if you have not done so already.
On the CloudFormation console, choose Create Stack.
Choose the provided CloudFormation pipeline template.
Choose Next.
Provide the stack parameters:
- Under Code, provide code details, such as repository name and the branch to trigger the pipeline.
- Under SAST, choose the SAST tool (SonarQube or PHPStan) for code analysis, enter the API token and the SAST tool URL. You can skip SonarQube details if using PHPStan as the SAST tool.
- Under DAST, choose the DAST tool (OWASP Zap) for dynamic testing and enter the API token, DAST tool URL, and the application URL to run the scan.
- Under Lambda functions, enter the Lambda function S3 bucket name, filename, and the handler name.
- Under STG Elastic Beanstalk Environment and PRD Elastic Beanstalk Environment, enter the Elastic Beanstalk environment and application details for staging and production to which this pipeline deploys the application code.
- Under General, enter the email addresses to receive notifications for approvals and pipeline status changes.

Note: The provided CloudFormation template in this blog is formatted for AWS GovCloud, if you are setting this up in standard region, you will have to adjust the partition name in the CloudFormation template. For example, change arn values from “arn:aws-us-gov” to “arn:aws”.

License

devsecops-cicd's People

Contributors

Stargazers

Watchers

Forkers

sushantkhandelwal78 z3r0c10wn technology-development dieguinsss migueleiva nitinbsonare chucknelson01 ewanemarc sandrociceros-orquestra ahkai86 brianmcmaster kmcquade tirumalesh123 gopinaath ab-group chillicoder vipalm qpc-database diegorosas12 folpindo kablitz-aws stevenbb2019 saq002 nadellar lambateanuja bnugent aqilshaikh fabriziomachado brinhosa stalinsham charanhari222 iyad87 mahendra1904 nikhil-arella devopsbroa khansuhaib phani-rudra9 mastouri-academy-inc alexlescionokpxlmax saradkc kodaegon setonjay sakar345 zeroc0d3 timecubu sandeepsharks anjudevsecops klapcsik raajkumar13 ritesh8403 kothi-04 google-320 mad-saint chronospaulh tinkuch moisestapia prathamesh199728 hemanth4134 claytonbrown nileshvmware karthikramiah tariqsheikhsw alwpnewbie gtmnagalla abiboye92 raysaini19 pavanh96 lexis55 fg-aws tech-save almeidadevops042 ram4164 cesarmsouza sadique-growexxer ayomideodukoya pavankumar13-hub gadapu hwmf anuu1989 raghudev94 dzhang64 awsnand chambujam chimezirimugochukwu manepals joanale273 pushprajhons lakshmibhavanin joekibz adam-babbit rahulc-bst pavantyagi sasushir matiasvillanueva97 psep shibaboy anushasiloju git-naunihal ajulunwajei himanshu-upadhyay7777

devsecops-cicd's Issues

Lambda ImportVulToSecurityHub

Hi , any help with this error .

import_findings_security_hub.zip

[ERROR] KeyError: 'messageType'
Traceback (most recent call last):
  File "/var/task/import_findings_security_hub.py", line 141, in lambda_handler
    return process_message(event)
  File "/var/task/import_findings_security_hub.py", line 27, in process_message
    if event['messageType'] == 'CodeScanReport':

devsecops-workshop-pipeline CF stack event Errors

I encountered multiple CF event errors when deploying the devsecops-workshop-pipeline CF Stack. Does anyone know how to resolve these errors

Question on SonarQube URL and OWASP ZAP URL

Hi ! have been able to launch Beanstalk architecture but i am missing the information of both 'SonarQube URL' and 'OWASP ZAP URL' , may i understand how to generate these 2 URLs?

I have launched a SonarQube portal is its hitting the URL of localhost:9000, is this the URL to set within the CloudFormation template under SonarQube SAST tool URL?

For OWASP ZAP URL, may i understand where to retrieve the URL?

Many thanks! =)

LambdaFunSecurityHubImport, PipelineKMSKey failed

any help with this error and i have uploaded the lambda-functions/ folder to S3

I get this error Resource handler returned message: "Error occurred while GetObject. S3 Error Code: NoSuchKey. S3 Error Message: The specified key does not exist. (Service: Lambda, Status Code: 400, Request ID: d9cdc8c8-0555-40a4-8176-d39671a3de13, Extended Request ID: null)" (RequestToken: 81731847-62db-6927-59ba-1b63c17614ca, HandlerErrorCode: InvalidRequest) in LambdaFunSecurityHubImport

LambdaHandlerName	import_findings_security_hub.lambda_handler	-
LambdaPackageLoc	bucket-devsecops-poc	-
LambdaPackageS3Key	lambda-functions/import_findings_security_hub.zip

The following resource(s) failed to create: [LambdaFunSecurityHubImport, TrailBucketPolicy, PipelineKMSKey, CloudWatchPipelineEventRule]. Rollback requested by user.

Any help here?

Error deploying java app to Elastic Beanstalk

When I executed pipeline I had a error with deploy java app:

I checked the beanstalk log (eb-engine.log) and I found this error:

These configuration was added in last commit d5e85bd. It seems that "server_tokens" setting already exists in the initial NGINX setup in Beanstalk so there is no need to add this again. I removed this from custom.conf file in my project and this worked for me.