Table Of ContentSecurity
SS
ee
cc
uu
rr
ii
tt
yy
as Code
aa
ss
CC
oo
dd
ee
DevSecOps Patterns with AWS
BK Sarthak Das
& Virginia Chu
Security as Code
DevOps engineers, developers, and security engineers have
ever-changing roles to play in today’s cloud native world. In
“An excellent guide.
order to build secure and resilient applications, you have to
Security as Code takes
be equipped with security knowledge. Enter security as code.
you from abstract
In this book, authors BK Sarthak Das and Virginia Chu concept to the working
demonstrate how to use this methodology to secure technology, people, and
any application and infrastructure you want to deploy.
processes. If you need to
With Security as Code, you’ll learn how to create a secure
actually do the work of
environment using CI/CD tooling from AWS and open source
shifting security left, this
providers. You’ll also see how a containerized application can
book is for you.”
be deployed as infrastructure as code (IaC) within AWS.
—Fritz Kunstler
This practical guide also provides common patterns and Principal, AWS Global Services Security
methods to develop secure and resilient infrastructure.
“The ultimate hands-on
• Learn the tools of the trade using Kubernetes and the AWS
security guide for DevOps
Code Suite
roles, covering tooling
• Set up IaC and run scans to detect misconfigured resources
and processes.”
in your code
—Michael Hausenblas
• Create secure logging patterns with CloudWatch and
Solution Engineering Lead, AWS
other tools
• Restrict system access to authorized users with role-based
access control (RBAC) BK Sarthak Das works at Google as a
security engineer and was previously
• Inject faults to test the resiliency of your application with
at AWS as a senior security architect.
AWS Fault Injection Simulator or open source tooling
Virginia Chu is a principal DevSecOps
• Learn how to pull everything together into one deployment engineer at AWS who began her career
as a Linux system administrator and
developer.
SECURITY Twitter: @oreillymedia
linkedin.com/company/oreilly-media
US $55.99 CAN $69.99 youtube.com/oreillymedia
ISBN: 978-1-098-12746-6
Security as Code
DevSecOps Patterns with AWS
BK Sarthak Das and Virginia Chu
BBeeiijjiinngg BBoossttoonn FFaarrnnhhaamm SSeebbaassttooppooll TTookkyyoo
Security as Code
by BK Sarthak Das and Virginia Chu
Copyright © 2023 Virginia Chu and BK Sarthak Das. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are
also available for most titles (http://oreilly.com). For more information, contact our corporate/institutional
sales department: 800-998-9938 or [email protected].
Acquisitions Editors: Jennifer Pollock, Simina Calin Indexer: Sam Arnold-Boyd
Development Editor: Sarah Grey Interior Designer: David Futato
Production Editor: Clare Laylock Cover Designer: Karen Montgomery
Copyeditor: Nicole Taché Illustrator: Kate Dullea
Proofreader: Rachel Head
January 2023: First Edition
Revision History for the First Edition
2023-01-03: First Release
See http://oreilly.com/catalog/errata.csp?isbn=9781098127466 for release details.
The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Security as Code, the cover image, and
related trade dress are trademarks of O’Reilly Media, Inc.
The views expressed in this work are those of the authors and do not represent the publisher’s views.
While the publisher and the authors have used good faith efforts to ensure that the information and
instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility
for errors or omissions, including without limitation responsibility for damages resulting from the use
of or reliance on this work. Use of the information and instructions contained in this work is at your
own risk. If any code samples or other technology this work contains or describes is subject to open
source licenses or the intellectual property rights of others, it is your responsibility to ensure that your use
thereof complies with such licenses and/or rights.
This work is part of a collaboration between O’Reilly and NGINX. See our statement of editorial
independence.
978-1-098-12746-6
[LSI]
Table of Contents
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
1. Introduction to DevSecOps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Before DevOps: The Software Development Life Cycle 3
What Is DevSecOps? 6
Introducing Automatoonz 7
Cloud Infrastructure: Secure by Default 8
Move Fast, Secure Fast: The Importance of Automation 9
DevSecOps Culture 10
Summary 11
2. Setting Up Your Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
What You’ll Need 13
Installing and Verifying Your Setup 14
Installing the AWS CLI 14
Installing the Docker Engine 15
Checking Your Python Version 15
Installing Git 16
Installing Kubernetes 16
Creating Your First Bare-Bones Pipeline 17
Summary 18
3. Securing Your Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
What Makes Infrastructure Secure? 21
Hands Off! Preventing Unwanted Access with IAM Permissions 22
Detecting Misconfigurations 23
Identifying a Standard 23
Threat Modeling 24
iii
Security Controls 24
Better Than a Cure: Implementing Preventive Controls 26
Implementation 28
Summary 33
4. Logging and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
What Are Logging and Monitoring—and Why Do They Matter? 35
Attack Styles 36
Advanced Persistent Threat Attacks 37
Ransomware Strains 38
Passive and Active Attacks 38
Log Types 40
Log Storage 41
Detecting Anomalies 44
Remediation with AWS Config 48
Correlating User Activity with CloudTrail 51
Network Monitoring with an Amazon VPC 53
Summary 55
5. Controlling Access Through Automation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
The Principle of Least Privilege 58
Fine-Tuning Access Controls 60
Use a Tagging System 60
Clarify Team Responsibilities 61
Prevent and Detect 62
The IAM Pipeline 63
Summary 66
6. Fault Injection Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Distributed Systems 67
Adaptive Security Controls 68
The True Cost of Downtime 69
Methods for Minimizing Downtime 69
Chaos Engineering 70
Basic Principles 71
Advanced Principles 74
Chaos Engineering in AWS Environments 76
Chaos Engineering at Automatoonz 78
AWS Fault Injection Simulator Experiment Examples 78
Kubernetes Pod Stress Testing 79
Throttling EC2 API Calls 80
Stress Testing the CPU on an EC2 Instance 81
iv | Table of Contents
Terminating an EC2 Instance 82
Removing Ingress and Egress Rules from a Security Group 83
Detaching an EBS Volume from an EC2 Instance 84
Summary 85
7. People and Processes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
People: Team Structures and Roles 87
Security Engineers 88
Developers 88
Compliance Team 89
Product Manager 90
Team Structure 90
Processes: Practices and Communication 92
Communicate to the Right People, Consistently 92
Make Product Owners Accountable for Their Security Findings 93
Build Threat Modeling into Your Processes 93
Build Roadmaps to Reach Your DevSecOps Goals 95
What Next? 95
Summary 96
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Table of Contents | v
Preface
The authors of this book work with enterprise AWS customers who have business-
critical applications running in the cloud, so we think about security on a daily
basis. In recent years, we’ve noticed that the term DevSecOps pops up in nearly every
security strategy discussion. Everyone wants it, but not as many people understand
it—and it seems like almost nobody knows where to start or what to do.
DevSecOps is a relatively new field, and few books are available to guide those who
want to learn more about it. We decided to write this book to help fill that gap by
showing you how and where to get started on DevSecOps in AWS.
This book is not an enterprise-grade solution kit for copying and pasting into pro‐
duction (and since every project and organization has different needs, we sincerely
hope you would never do that!). Instead, it’s designed to introduce you to the building
blocks of the DevSecOps mindset, and to guide you along the way with practical
examples. We use popular open source tools where possible, to show you that it’s not
always necessary to buy expensive products to do security the right way.
We use a fictitious company called Automatoonz to illustrate some of the real-world
issues you’re likely to face in your DevSecOps journey. As we discuss a problem, the
Automatoonz team works on it too, giving you a sense of how real teams approach
solving the problem at hand. Although the scenarios are fictionalized, these examples
come from our extensive personal experience, and we think they’ll resonate with you.
The solutions we provide in this book are intended as guidance on the art of the
possible.
Who Is This Book For?
This book is for AWS security engineers, DevOps engineers, security analysts, secu‐
rity engineering managers, and other practitioners and leaders at intermediate and
senior levels who want to automate more of their security. We recommend that
readers have some practical AWS development knowledge and familiarity with Git
vii
before starting this book: ideally, enough to do basic coding and debugging within
AWS. In Chapter 2, for example, we use CloudFormation, Python, and Kubernetes to
demonstrate Infrastructure as Code. You should also be comfortable navigating Git
repositories.
What Do You Need To Get Started?
In practical terms, aside from intermediate knowledge of AWS, to follow the exercises
in this book you will need an AWS account where you can deploy. You will also need
to install the following, if you do not already have them:
•• AWS Command Line Interface (AWS CLI) (latest version)
•• Access to an AWS account
•• Docker (Community Edition)
•• Python (version 3.x.x or higher)
•• Git (latest version)
•• Kubectl (latest version)
•• Kubernetes (version 1.21 or higher)
Chapter 2 has a detailed walkthrough of setting up all these tools.
You will also need access to the book’s GitHub repository, which includes code
samples and other supplemental materials.
What’s in This Book?
We’ve tried to ensure that the seven chapters in this book are as independent as
possible from one another, so that you can pick it up at any point. However, we
recommend that you start from the beginning.
Chapter 1 will introduce you to what DevSecOps is, why it is important, and what
kind of mindset you’ll need to get started. Chapter 2 helps you install the software
you’ll need for the rest of the book, then walks you through a sample application built
with secure configurations to ensure you have your toolkit working. In Chapter 3,
you’ll learn how to validate Infrastructure as Code to make your resources secure.
Chapter 4 looks at how to set up appropriate logging and monitoring to identify and
debug issues with your infrastructure.
In Chapter 5, you’ll learn about controlling access through automation, including
assessing your organization’s identity and access management (IAM) policies and
refining them according to the principle of least privilege. Chapter 6 is all about
testing: we’ll introduce you to the practice of Chaos Engineering, show you how
viii | Preface
