AWS Security: DevSecOps & AWS Security Services & Terraform

Explore key security terms used throughout the course, including SAST (static application security testing), SCA (software composition analysis), DAST, IAST, and IaC security, plus API security and microservices concepts.

Define devsecops as integrating development, security, and operations with security at the core; use shift-left, secure coding checks, and automated compliance scans to prevent production issues, including PCI DSS standards.

Explore enterprise devsecops tools across code and builds, including git secrets and trufflehog. Review sast, dast, infrastructure as code security, container scanning, and cloud posture tools.

Learn how to implement DevSecOps in AWS using CodeCommit, CodeBuild, and CodePipeline, and integrate security tools like Fortify, SonarQube, and Veracode via YAML files.

Create an AWS free tier account by entering a root email, choosing an account name, verifying email, providing phone and address, and adding a payment method to access the dashboard.

Connect git bash to AWS CodeCommit by creating a new repository, configuring IAM user credentials, and cloning, pushing, and pulling files between local and CodeCommit repositories.

Push vulnerable java reachability playground from GitHub to AWS CodeCommit using Git Bash, including git add, commit, and push on the master branch.

Explore how sonarcloud, a software as a service platform, enforces code quality and security, defines customizable quality gates, and integrates with your build system to run coverage checks.

Create and configure a buildspec.yaml in your AWS code commit project to run maven verify and sonar analysis with SonarCloud, including project key, organization, host, and token.

Create a SonarCloud account, organization, and project, then generate a security token. Update the buildspec.yml with the token, organization name, and project key to enable SonarCloud analysis with CodeCommit.

Create a CodeBuild project to build code from a CodeCommit repo using buildspec.yml, run Maven verify, and perform a SonarCloud SAST analysis to identify code smells.

Move the sonar token from buildspec.yml to AWS Secrets Manager as first secret with token for sonar, and grant CodeBuild access to Secrets Manager for SonarCloud analysis.

Explore OWASP ZAP, the open source web application security scanner for web apps and API specifications, and learn its benefits for both new and professional penetration testers.

Configure AWS CodeBuild to store build artifacts in an S3 bucket by updating the build project's artifacts settings, so future builds upload artifacts to the selected bucket.

Integrate OWASP ZAP as a DAST scan in an AWS DevSecOps pipeline by configuring a buildspec.yml to run a scan against https://www.example.com and store the zap_report.html artifact.

Explore a case study to understand project requirements before implementing an end-to-end AWS devsecops pipeline for a Java project, featuring Maven build, Sonarcloud SAST, Sneak SCA, and OWASP ZAP DAST.

Create a free Jira account with Atlassian, sign in via Google, set up security guru test.atlassian.net, and initialize a DevSecOps project to report security issues to the development team.

Report a high-severity sast issue (command injection) detected by SonarCloud in the Vulnado application using Jira, detailing the vulnerable code, file path, commit id, and references for sprint 1 remediation.

Integrate SonarCloud with JIRA to create tickets with one click. Configure the connector, set the SonarCloud URL, generate a SonarCloud token, and map issue types.

Explore how AWS Security Hub consolidates findings from GuardDuty, Macie, Inspector, and Config into a central dashboard, enabling automated security checks and actions based on severity.

Enable aws config as a prerequisite and apply CIS AWS Foundations Benchmark, foundation security best practices, and PCI DSS standards in AWS Security Hub to surface regional findings.

Learn how Amazon Detective analyzes AWS logs to visualize and identify the root causes of security findings, enabling rapid incident investigations and identifying the source of denial-of-service attacks.

Learn how GuardDuty works as a threat detection service by analyzing VPC flow logs, CloudTrail management logs, and other data, and how to enable it with Security Hub integration.

Review GuardDuty findings, learn to suppress and archive alerts, and configure trusted IP lists, S3 and Kubernetes protection, and multi-account GuardDuty from a central security account.

Analyze how the AWS IAM access analyzer monitors policies across resources, detects external access findings, and surfaces them in Security Hub and the access analyzer dashboard for action.

Explore how AWS Audit Manager integrates with Security Hub to audit AWS services against PCI DSS, CIS, and AWS best practices, define scope, gather evidence, and generate audit ready reports.

Create an assessment in AWS Audit Manager to collect automated evidence across services using the standard framework, map data sources, assign owners, and monitor active controls.

Review Security Hub integrations, examine the security score of 72%, and analyze findings from CIS, PCI DSS, and AWS foundation rules, including GuardDuty findings and suppression for weekly reporting.

Download terraform for Windows 64-bit (amd64), open the zip, and place terraform.exe in a folder on the D drive. Add folder to the system path and verify with terraform -h.

Create an AWS admin user with programmatic access in IAM, attach the Administrator Access policy, and generate access keys. Prepare to log in and use the CLI next.

Install and configure the AWS CLI on Windows, authenticate with your AWS access key and secret, set a default region (us-west-2), and verify identity with STS get-caller-identity.

Clone the repo on your local system to access Terraform files that provision an AWS EC2 instance and install Jenkins, enabling an end-to-end devsecops pipeline with Kubernetes.

Explore the terraform aws infra repo in Visual Studio Code, review main.tf and related files, and prepare infrastructure with terraform for DevSecOps using Jenkins and Kubernetes, with SAST, SCA, DAST.

Explore how to use terraform to define AWS infrastructure, including security groups, an EC2 instance with IAM role, key pair, and user data to install Jenkins.

Explore shell script used with Terraform to install Jenkins, Java, Maven, Git, AWS CLI, ZAP, kubectl, eksctl, Docker, and jq on an EC2 instance, configuring Jenkins port 8081 for DevSecOps.

Use a terraform variable file to set aws_region, vpc_id, and key_name, generate an AWS key pair, and apply terraform with -variable-file to create an EC2 in us-west-2.

Execute a terraform script to provision aws infrastructure, initialize backend and provider, run plan and apply to create an ec2 instance with jenkins, security groups, in us-west-2, on port 8081.

Create a Kubernetes cluster on AWS using eks ctl from an EC2 instance, load the kube config, and verify two ready nodes and an available control plane.

Clean up the resources created in the course by deleting the kubernetes cluster with eksctl and destroying Terraform resources, including the ec2 instance and associated stacks.

Create a Qualys total cloud platform account to enable CSPM on AWS and learn how to configure connectors for vulnerability and posture management.