DevSecOps & DevOps with Jenkins, Kubernetes, Terraform & AWS

Define devsecops as development, security, and operations with security at the core; implement security early in development and follow the shift lift approach to identify issues early.

Explore devsecops tooling, from git secrets and shift-left ide plugins to sast, dast, and container security. Assess build pipelines, infrastructure as code security, container registry scanning, and cloud posture management.

Explore key security terms used in this course, including SAST, SCA, DAST, IAST, IAC, and API security, and clarify the API versus microservice distinction.

Master the basics of Terraform by writing configuration files that model infrastructure as code, using a city-building analogy to plan, apply, and destroy cloud resources.

Download Terraform.exe for Windows from HashiCorp, choose amd64, unzip, and copy Terraform.exe to D:\security guru\Terraform. Add this folder to the system path, then run terraform -h in cmd to verify.

Create a free AWS account and complete the initial setup, including root user email, account name, verification, and payment details, then access the AWS dashboard to prepare DevSecOps.

Create an AWS admin user by adding a new IAM user, attaching administrator access, and generating programmatic access keys for use with the AWS CLI.

Install AWS CLI version 2 on Windows with the MSI installer, then authenticate using your access key and secret key, and verify identity with STS get-caller-identity.

Install Visual Studio Code on Windows 10 by downloading from code.visualstudio.com, selecting the correct 64-bit or 32-bit installer, and finalizing with desktop icon and path setup.

Install Git Bash on your local system to clone repositories, make commits, and push changes, guided by step-by-step options for Windows, Linux, and Mac.

Clone the Terraform repo on your local system to set up an AWS infrastructure for an end-to-end DevSecOps pipeline with Jenkins, Kubernetes, and EC2.

Open the Terraform repo in Visual Studio Code, inspect the vars folder, tfvars, and main.tf, and learn how the Terraform script provisions AWS infrastructure for DevSecOps with Jenkins and Kubernetes.

Learn how a main.tf Terraform script provisions an AWS EC2 instance, security groups, an IAM role with admin permissions, and a Jenkins setup via user data for DevSecOps.

Install and configure Jenkins and supporting tools on an EC2 instance via a shell script in Terraform, including openjdk11, git, Maven, AWS CLI, ZAP, kubectl, eksctl, Docker, and JQ.

Explore how the dev-west-2.tfvars file supplies aws_region and key_name to main.tf, and how to create an AWS key pair in us-west-2 for Terraform to access the EC2 instance.

Deploy AWS infrastructure with a Terraform script, from init to apply, using terraform.lock.hcl, and provision an ec2 instance running Jenkins for DevSecOps.

Set up Jenkins on an AWS EC2 instance, extract the initial admin password, install default plugins, create the admin user, and prepare for a DevSecOps pipeline with Kubernetes and TerraForm.

Configure Maven in Jenkins by adding a Maven installation named Maven_ in Global Tool Configuration, specifying the installed Apache Maven 3.5.2 on EC2 instance as Maven home, and save.

Install essential Jenkins plugins for a devsecops workflow, including Docker pipeline, AWS credential plugin, Amazon ECR, and Kubernetes CLI, enabling Docker image builds and Kubernetes commands.

Explore SonarCloud, a cloud-based SaaS platform that enforces code quality and security by defining customizable quality gates, including a default 80% coverage, and easy build-system integration via APIs.

Create a SonarCloud account by signing in with GitHub, Bitbucket, GitLab, or Azure DevOps on sonarcloud.io, then access the dashboard and get ready to create projects.

Integrate sonarcloud into a DevSecOps pipeline with Jenkins, using a declarative Jenkinsfile to run mvn builds and sonar analysis, and configure project key, organization, host url, and token.

Identify how Snyk, a cloud-based security tools provider, uncovers security issues in source code, open source libraries, containers, and infrastructure as code via software composition analysis and SAST.

Create a Snyk account using GitHub to perform software composition analysis on source code, identify security issues in third-party libraries like Log4J, and set up integration with the DevSecOps pipeline.

Integrate software composition analysis in a Jenkins DevSecOps pipeline using the snyk Maven plugin to scan third-party libraries for vulnerabilities. Leverage Jenkins credentials and the -fn flag to prevent failures.

Build and push a Docker image in Jenkins by configuring Docker login credentials, push the image to AWS ECR, and prepare for Kubernetes deployment and DAST scanning.

Create a private aws ecr repository named asg, then configure aws credentials in Jenkins credential manager to enable pushing the docker image using the https ecr url.

Learn how to update a Jenkins pipeline to build and push a docker image to AWS ECR, including docker and AWS logins, and run sonar analysis and SCA scans.

Connect to an EC2 instance and run eksctl to create a Kubernetes cluster. Wait for the cluster stack to deploy, then save the kubeconfig and verify two nodes with kubectl.

Deploy a docker image from AWS ECR to a Kubernetes cluster via a Jenkins pipeline, using deployment.yaml and a load balancer in the DevSecOps namespace, with kube login configured.

Deploy a docker image to a Kubernetes cluster via a DevSecOps pipeline in Jenkins, with SAST and SCA scans, pushing to AWS ECR for deployment in the DevSecOps namespace.

Explore OWASP ZAP, the open-source Zed Attack Proxy, a security scanner for web apps and API specifications, widely used in enterprises.

Integrate a DAST scan into a Jenkins-driven DevSecOps pipeline for a web app deployed on Kubernetes, using zap.shell to scan the dynamic load balancer URL after deployment.

Execute an end-to-end DevSecOps pipeline in Jenkins, running sonar and snyk analyses, building and pushing Docker images to AWS ECR, deploying to Kubernetes, and performing a Zap dast scan.

Delete the Kubernetes cluster and its related resources using the Terraform repo commands. Destroy all Terraform-managed resources, including the EC2 instance, with Terraform destroy.