SEC11-BP07 Regularly assess security properties of the pipelines
Apply the principles of the Well-Architected Security Pillar to your pipelines, with particular attention to the separation of permissions. Regularly assess the security properties of your pipeline infrastructure. Effectively managing the security of the pipelines allows you to deliver the security of the software that passes through the pipelines.
Desired outcome: The pipelines used to build and deploy your software should follow the same recommended practices as any other workload in your environment. The tests that are implemented in the pipelines should not be editable by the builders who are using them. The pipelines should only have the permissions needed for the deployments they are doing and should implement safeguards to avoid deploying to the wrong environments. Pipelines should not rely on long-term credentials, and should be configured to emit state so that the integrity of the build environments can be validated.
Common anti-patterns:
-
Security tests that can be bypassed by builders.
-
Overly broad permissions for deployment pipelines.
-
Pipelines not being configured to validate inputs.
-
Not regularly reviewing the permissions associated with your CI/CD infrastructure.
-
Use of long-term or hardcoded credentials.
Benefits of establishing this best practice:
-
Greater confidence in the integrity of the software that is built and deployed through the pipelines.
-
Ability to stop a deployment when there is suspicious activity.
Level of risk exposed if this best practice is not established: High
Implementation guidance
Starting with managed CI/CD services that support IAM roles
reduces the risk of credential leakage. Applying the Security
Pillar principles to your CI/CD pipeline infrastructure can help
you determine where security improvements can be made. Following
the
AWS Deployment Pipelines Reference Architecture
Implementation steps
-
Start with the AWS Deployment Pipelines Reference Architecture
. -
Consider using AWS IAM Access Analyzer to programmatically generate least privilege IAM policies for the pipelines.
-
Integrate your pipelines with monitoring and alerting so that you are notified of unexpected or abnormal activity, for AWS managed services Amazon EventBridge
allows you to route data to targets such as AWS Lambda or Amazon Simple Notification Service (Amazon SNS).
Resources
Related documents:
Related examples:
-
DevOps monitoring dashboard
(GitHub)
