Hands-On DevSecOps: Secure CI/CD with Jenkins on AWS

Learn how Apache Maven helps build Java packages using the project object model and pom.xml, which defines groupId, plugins, dependencies, version, and artifact location.

Explore Maven build lifecycles—the default, clean, and site—and learn the seven phases: validate, compile, test, package, verify, install, and deploy.

Explore three types of maven repositories—local, remote and private, and central and public—and how dependencies flow from the pom.xml to the local .m2 cache, producing artifacts in the target directory.

Provision an AWS Maven server, install Java 11, install Maven, check out the Spring Boot project from GitHub, and build the package with Maven.

Clone the spring boot project from GitHub to your Maven server, install git, and prepare the pom.xml to build the package with Maven.

Explore the Maven life cycle by validating the project and packaging it into a distributable jar, while downloading dependencies into the dot m2 repository.

Explore the pom.xml file to understand how artifact id and version determine the generated jar file, how mvn package creates artifacts, and how changes affect packaging and timestamps.

Change the pom.xml version from 2 to 3, then run mvn clean package to delete prior artifacts and rebuild in the target directory; using mvn package without clean retains artifacts.

Access the spring boot application via URL after running the jar and enabling port 8080 in the security group. Rebuild the artifact with mvn clean package and verify access.

Investigate how a compiled package builds using maven, managing dependencies via the palm dot XML and repositories file, choosing local cache over downloads from the public website.

Explore the Apache Maven build lifecycle, from package to deploy, and learn how to publish artifacts to a remote repository with ambient deployer in a CI/CD workflow.

Clone a spring boot web application from GitHub, edit pom.xml, and build with mvn package to create a .var artifact in the target directory.

Explore static application security testing (sast) to identify vulnerabilities in source code without execution, enabling early fixes in a Jenkins–Maven–SonarQube CI/CD workflow with real-time feedback and dashboards.

Set up a Jenkins server on AWS EC2 with Red Hat Linux, install Java and Git, and configure for continuous integration using Maven, GitHub, and SonarQube or SonarCloud.

Install Maven 3.9.6, git, and Java, then install Jenkins via the Jenkins Linux rpm repository, using wget, dnf, and tar to complete the setup.

Start, verify, and enable the Jenkins service with systemctl, open port 8080 in the security group, access via the server IP, and prepare to configure Jenkins in the next lecture.

Unlock the Jenkins admin by extracting the encrypted password from the log, then install suggested plugins to complete secure configuration and continue in the next lecture.

Create the first admin user and sign in to the Jenkins dashboard. Integrate Maven, SonarQube, and GitHub with Jenkins to enable continuous integration from the GitHub source.

Log in to a GitHub repository, select the project, and integrate Maven with Jenkins on the Jenkins server. Configure Maven installation, set the home path, and apply and save.

Learn to check out a GitHub project with a declarative Jenkins pipeline, using agent any and a Maven tool, including a checkout stage that clones master and runs in Jenkins.

Build the package in the Jenkins declarative pipeline using mvn clean package, then generate the jar in the target directory and plan code quality checks with SonarQube or SonarCloud.

Log in to sonar cloud with your GitHub account, create an organization and a project for code analysis. Set project key and add a sonar analysis stage to your pipeline.

Demonstrates integrating sonar analysis into a Jenkins pipeline by running mvn clean verify with sonar:sonar, configuring project key, organization, host URL, and token authentication for SonarCloud.

Generate a security token from SonarCloud and configure Jenkins to authenticate for project analysis, then run a pipeline to view issues and security hot spots on SonarCloud.

Demonstrate setting up a Jenkins pipeline to clone a vulnerable project, run sonar cloud analysis, and deliver a developer-ready report with GitHub, Maven, and sonar cloud integration.

Unzip the SonarQube package, install unzip via apt, then configure and start the SonarQube service as a non-root ubuntu user, adjusting sonar.sh and ownership to run smoothly.

Install and configure the SonarQube Scanner plugin in Jenkins to enable code analysis of a GitHub repository, using a SonarQube authentication token and Jenkins credentials for secure integration.

Integrate SonarQube with Jenkins by adding a SonarQube server in the Manage Jenkins system, name it, enter the server URL and credentials, and save to complete the integration.

Explore building a Jenkins pipeline that checks out GitHub project, builds with mvn clean package, and performs a SonarQube quality check using the SonarQube Scanner for Jenkins with stored credentials.

Resolve a Jenkins pipeline failure by installing git, enabling checkout and build, then run sonar analysis. The report reveals bugs, vulnerabilities, and code smells for DevOps remediation.

Explore how snake secures code from first line to cloud with static application security testing, software composition analysis, and open source and container vulnerability identification on AWS via Terraform.

Set up a Jenkins server on Red Hat, install Java 11 and Maven, and integrate Jenkins with Maven, SonarCloud, and Snyk to enable ci, code quality analysis, and vulnerability scanning.

Install apache maven on the CI server by installing wget, downloading, and extracting Maven. Then install java, git, and Jenkins via rpm with yum, setting up Jenkins for web access.

Start the Jenkins service, enable it, and access the CI server on port 8080 via the AWS security group, then prepare to configure Jenkins in the next lecture.

Configure the Jenkins server securely by retrieving the administrator password from the log file, then customize Jenkins by installing the suggested plugins to support various needs.

Create the first admin user on the Jenkins server with a username, password, full name, and email, then explore the dashboard and create new items and jobs.

Configure Maven in Jenkins with version 3.9.6 and the Maven home path, then log into Snyk (via GitHub or Google) and link it to sonar cloud for Jenkins integration.

Integrate the Snyk Maven plugin into pom.xml and configure a Jenkins pipeline to run mvn snyk test for SCA analysis on a vulnerable Java project.

Learn to run SCA analysis using Snyk by configuring the Snyk token in Jenkins credentials, integrating the Snyk plugin, and triggering builds in a secure CI/CD pipeline.

Run SCA analysis with snyk in a Jenkins on AWS pipeline, review sonar cloud and snyk reports, and apply upgrade recommendations, including MySQL version upgrades.

This lecture explains building a java package, integrating sonar cube and sonar cloud, creating a docker image, and pushing it to AWS ECR via Jenkins with repository setup.

Configure a Jenkins pipeline to compile a Java project, run sonar and Snyk analyses, and build and push a Docker image to AWS ECR.

Configure a Jenkins server with docker, install key plugins, and run a pipeline that builds and tags a docker image for aws ecr deployment after sonar and snyk analyses.

Push your Docker image from the Jenkins server to AWS ECR via Jenkins pipeline. Establish authentication, install the AWS CLI, and configure its path.

Configure a Jenkins pipeline to deploy a Docker image to AWS ECR by creating an IAM user with ECR access, generating access keys, and adding them as Jenkins credentials.

Configure AWS credentials in Jenkins via global credentials, add registry credentials, and run a build to troubleshoot missing credentials encountered in lab 5.

Set up a continuous deployment server on Ubuntu, connect to AWS ECR, pull the Docker image, and run it as a container after installing AWS CLI and Docker.

Install the AWS CLI on Ubuntu, verify the version, then install Docker, address credential issues, and create a role to enable communication with AWS ECR.

Create an IAM role for EC2, attach the Amazon EC2 Container Registry full access policy, and assign the role to an EC2 instance to enable EC2–ECR communication.

Deploys and runs a docker image from AWS ECR on the CD server, verifying login, launching a container, exposing a port, and confirming the application is running.

Configure port 8080 and security groups, pull the AWS ECR image, run it as a container, and verify access via Jenkins CI/CD with sonar analysis for bugs and vulnerabilities.

Create a fresh AWS EKS cluster to deploy your docker image in ECR, configuring the IAM role, networking with the default VPC, public cluster endpoint access, and add-ons.

Launch a client machine and configure the AWS CLI credentials to access the in-progress EKS cluster, then run kubectl and eksctl to manage the master node, deployments, and services.

configure aws cli on amazon linux 2, avoid root keys by creating a normal user with access keys, and set Mumbai region and json output for secure ci/cd workflows.

Use the AWS CLI to describe the cluster and query its status; with configured AWS CLI credentials, this confirms the cluster is active.

Install kubectl and ecctl, then update the kubeconfig with the AWS CLI to configure the cluster context and API server credentials, enabling communication with the control plane.

Install kubectl on Amazon Linux 2 by following the official installation steps and set execute permissions on the binary. Verify the installation by checking the kubectl version.

Install eksctl on your client machine by downloading the latest release, extracting it to /tmp, moving it to the target location, and verifying the installation with a version check.

Downgrades the kubectl version to resolve an invalid apiVersion error, confirms connection to the master node, notes no worker nodes yet, and previews adding nodes in the next lecture.

Create a worker node group for the active EKS cluster by configuring an IAM role with EKS CNI and worker node policies, deploying two t2.micro nodes.

Track the build and deployment of a docker image from AWS ECR into a compute EKS cluster, verify node readiness with kubectl, and access the app to confirm deployment.

Learn to add a new project in a Jenkins pipeline, build a Docker image, and deploy to an ECS cluster with deployment.yaml and service.yaml.

Attach an IAM role to the ECS client to enable secure communication with AWS ECR, install Docker on Amazon Linux 2, and troubleshoot image pull permissions for continuous deployment.

Extend a Jenkins pipeline with an sshagent stage to securely transfer deployment and service YAML files to a client ECS machine using SCP and a private key.

Copy two files from a Jenkins server to an EKS client using ssh-agent and scp, verify the transfer on the client, and prepare to execute them in a Jenkins pipeline.

Create and apply an image pull secret for AWS ECR in deployment.yaml, use kubectl to create a docker-registry secret in the security app namespace, enabling secure image pull from ECR.

Troubleshoot deployment.yaml errors by examining pod scaling failures, then reconfigure the cluster by deleting and recreating a node group with t3.medium instances to replace worker nodes.

Add two steps to copy the deployment file and create service.yml in the security app namespace using kubectl to apply -f. Verify the deployment and service are running.

Walks through a complete ci/cd pipeline in Jenkins, covering checkout, compile, sonar analysis, sneak build, Docker image deployment to ECS, and accessing the application via the ECS endpoint.

Test your running web application in Kubernetes with the jab tool for dynamic application security testing, generating a report and integrating jab into the Jenkins pipeline.

Add a stage in a Jenkins pipeline to wait for the application to start, run SSH commands, and verify deployment on a Kubernetes cluster before deploying to ECS.

Install the Zap tool on the cluster by downloading its package on the client machine, creating a directory, making it executable as root, running the installer, and verifying the installation.

Learn to run the jab tool against the load balancer URL to analyze a web app, generating jab_report.html, and integrate with Jenkins for secure CI/CD on AWS.

Add a Jenkins pipeline stage to copy the script H from the repository into the ecs client during the ci/cd workflow.

Add a stage for DAST using ZAP tool in a Jenkins pipeline to perform dynamic application security testing on a web app, validating vulnerabilities via SSH agent and script execution.

Execute the Jenkins job for a dast scan, monitor logs with set -x debugging, and review the load balancer URL as the Zap tool analyzes the web app.

Watch how Jenkins advances a job to the next stage, starts the jeb tool, and runs a spider scan to produce an HTML jeb_report in a temp location. View the resulting report in a web page as it transfers to the specified HTML file for later analysis.

Access the zap report via the web page after active scanning in a Jenkins pipeline on aws, and review the 132 kb yml summary of high and medium alerts.

Delete the running eks cluster after the exercise to avoid charges, using eksctl delete cluster --name the cluster name, or delete the worker node group from the console.

Demonstrates a real-time bingo app deployment via a Jenkins-driven ci cd pipeline with devsecops on AWS, integrating Git, Node.js, SonarQube, Trivy, and Docker.