Pipeline Security

Each pipeline stage should have minimal IAM permissions. Use separate IAM roles for source, build, test, and deploy stages.

{
  "RoleName": "CodeDeployServiceRole",
  "AssumeRolePolicyDocument": {
    "Statement": [{
      "Effect": "Allow",
      "Principal": { "Service": "codedeploy.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }]
  },
  "Policies": [{
    "PolicyName": "DeployToECS",
    "PolicyDocument": {
      "Statement": [{
        "Effect": "Allow",
        "Action": ["ecs:UpdateService", "ecs:DescribeServices"],
        "Resource": "arn:aws:ecs:us-east-1:123456789012:service/prod/api-service"
      }]
    }
  }]
}

Separation of duties: developers can push code but not deploy to production. Operations can approve deployments but not modify build configurations. Security can audit but not change infrastructure.

Pipeline-level policies control who can view, edit, or execute pipelines. Use IAM conditions to restrict pipeline executions to specific branches or tags.

Never hardcode secrets in pipeline configurations, buildspec files, or source code.

AWS Secrets Manager stores and rotates secrets automatically:

aws secretsmanager create-secret \
  --name prod/api/database-password \
  --secret-string 'MySecurePassword123!'

Reference secrets in CodeBuild:

# buildspec.yml
env:
  secrets-manager:
    DB_PASSWORD: prod/api/database-password:password

Parameter Store stores configuration data and secrets. Use SecureString type for sensitive values:

aws ssm put-parameter \
  --name /prod/api/db-password \
  --value MySecurePassword123! \
  --type SecureString \
  --key-id alias/aws/ssm

Pipeline environment variables reference secrets from Secrets Manager or Parameter Store. CodeBuild decrypts them at build time. Never log secrets to build output.

OIDC for pipeline authentication: Use OpenID Connect to authenticate pipelines with AWS without long-lived credentials. GitHub Actions and CodePipeline support OIDC federation.

Pipeline artifacts (build outputs, deployment packages) must be encrypted at rest and in transit.

S3 bucket encryption: Enable SSE-KMS or SSE-S3 encryption on artifact buckets:

ArtifactBucket:
  Type: AWS::S3::Bucket
  Properties:
    BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms
            KMSMasterKeyID: !Ref ArtifactKMSKey
    PublicAccessBlockConfiguration:
      BlockPublicAcls: true
      BlockPublicPolicy: true

Vulnerability scanning in builds: Integrate security scanning into the build phase:

• Container scanning: ECR image scanning, Trivy, Snyk Container
• Dependency scanning: npm audit, Snyk, Dependabot
• SAST: SonarQube, CodeQL, Semgrep
• IaC scanning: Checkov, tfsec, cfn-nag

# buildspec.yml
phases:
  build:
    commands:
      - npm audit --production
      - trivy image myapp:latest --severity HIGH,CRITICAL
      - checkov -d ./infrastructure

Fail the build on critical vulnerabilities. Use quality gates to enforce security thresholds.

Comprehensive audit logging tracks all pipeline activities for compliance and forensics.

CloudTrail logs all API calls: who triggered the pipeline, what changes were deployed, who approved deployments.

CloudWatch Logs store build logs, test results, and deployment output. Set retention policies for compliance (7 years for financial, 3 years for general).

Approval gates enforce human review before critical deployments:

ApprovalAction:
  ActionTypeId:
    Category: Approval
    Owner: AWS
    Provider: Manual
    Version: '1'
  Configuration:
    CustomData: 'Review deployment to production'
    NotificationArn: !Ref ApprovalSNSTopic

Compliance controls:

• Branch protection: require PR reviews before merge
• Signed commits: verify code authorship
• Deployment windows: restrict deployments to business hours
• Change management: link deployments to tickets
• Rollback procedures: document and test rollback steps

Pipeline monitoring: Use CloudWatch dashboards to track pipeline health, deployment frequency, success rates, and mean time to recovery.