c3.10 Build a DevSecOps pipeline

Automate security into continuous delivery

Adopt continuous-delivery pipelines where build, provisioning, quality tests, security tests, and monitoring are automated, and security is considered from the very start of a release — not at the end.

Start from AWS guidance and accelerators

DevSecOps is a methodology, not a single AWS service to "turn on". To design and standardize your pipeline, start from AWS's prescriptive material:

• Designing a DevSecOps mechanism — prescriptive guidance for building the mechanism.
• AWS DevOps Pipeline Accelerator (DPA) — templates that stand up a complete, standardized CI/CD pipeline for applications or infrastructure.
• AWS Well-Architected DevOps Guidance — the best-practice framework, with a development lifecycle that has security built in.

AWS DevOps Agent complements the pipeline on the operations side: it is an AI agent that reviews release readiness and testing, and acts as an autonomous on-call engineer for incident response and reliability across AWS, multicloud, and on-premises. Use it to strengthen the "Ops" of DevSecOps — its deeper fit is in the operations and incident-response controls (see Automate critical playbooks and Advanced security automations). It does not replace the pipeline's security testing below, which is still SAST/DAST/SCA and secret scanning.

Harden the base in the pipeline

If you deploy to instances:

• Rebuild base images regularly with current patches using EC2 Image Builder.
• Add the Amazon Inspector agent so instances are continuously checked for OS and application vulnerabilities.
• Apply OS hardening (for example CIS benchmarks); Inspector can verify alignment.

Test applications and block on critical findings

Run SAST and DAST plus software composition analysis as part of the pipeline, and stop promotion to production when a high or critical vulnerability is found. The earlier a flaw is caught, the cheaper it is to fix. AWS CodePipeline can orchestrate these stages.

Deploy protective controls as code

When a known vulnerability cannot be fixed yet (for example a third-party dependency), deploy compensating controls — such as custom AWS WAF rules — as part of the pipeline until the fix ships. See using CI/CD to deploy AWS security services with Terraform.