Building Cloud DevSecOps Pipelines (In Theory)

Author: Damien Burks

Stages of a Cloud DevSecOps Pipeline (Terraform Deployment)

In this example, I’m using a Jenkins pipeline with Terraform for cloud infrastructure as code (IaC) to provision and manage cloud environments. The Jenkins pipeline includes stages to lint and validate Terraform configurations, scan for security issues, apply infrastructure, and perform post-deployment testing.

The outline listed below is sudo code, with an small explanation in each stage to follow:

pipeline {
    agent any

    environment {
        AWS_CREDENTIALS = credentials('aws-access-key-id')  // Example for AWS IAM credentials
        TF_VERSION = '1.0.11'                              // Terraform version
        TERRAFORM_DIR = 'terraform'                        // Terraform directory
        SNYK_ORG_NAME = "snyk-org-id"
    }

    stages {
        stage('Checkout Code') {
            steps {
                // Checking out code from version control system (GitHub, GitLab, Gitea, etc.)
                checkout scm
            }
        }

        stage('Terraform Init') {
            steps {
                // Initializing Terraform in the specified directory
                sh """
                terraform -version
                cd ${TERRAFORM_DIR}
                terraform init
                """
            }
        }

        stage('Terraform Lint') {
            steps {
                // Running terraform fmt to check for formatting issues
                sh """
                cd ${TERRAFORM_DIR}
                terraform fmt -check
                """
            }
        }

        stage('Terraform Validate') {
            steps {
                // Validating the Terraform configuration
                sh """
                cd ${TERRAFORM_DIR}
                terraform validate
                """
            }
        }

        stage('Terraform Plan') {
            steps {
                // Running terraform plan to check the changes that will be applied
                sh """
                cd ${TERRAFORM_DIR}
                terraform plan -out=tfplan
                """
            }
        }

        stage('Security Scanning') {
            parallel {
                stage('Checkov Scan') {
                    steps {
                        // Scanning the Terraform configuration for misconfigurations
                        sh """
                        cd ${TERRAFORM_DIR}
                        checkov --directory . --quiet
                        """
                    }
                }
                stage('Snyk Scan') {
                    steps {
                        // Running Snyk to check security issues in the Terraform configurations and generate a report
                        sh """
                        cd ${TERRAFORM_DIR}
                        snyk iac test --severity-threshold=high --org=${SNYK_ORG_NAME} --report
                        """
                    }
                }
            }
        }

        stage('Terraform Apply') {
            when {
                expression {
                    return params.APPLY_TERRAFORM == true  // Optional parameter to conditionally apply
                }
            }
            steps {
                // Applying the Terraform plan to the cloud provider (e.g., AWS, GCP, Azure)
                sh """
                cd ${TERRAFORM_DIR}
                terraform apply -auto-approve tfplan
                """
            }
        }

        stage('Post-Deployment Testing') {
            steps {
                // Run integration tests or security tests after infrastructure deployment if you're like to. This
                // can look completely different for everyone's use case to ensure your infrastructure is alive.
                sh """
                cd ${TERRAFORM_DIR}/tests
                ./run-post-deployment-tests.sh
                """
            }
        }
    }

    post {
        always {
            // Example: Archiving Terraform logs and test results
            archiveArtifacts artifacts: '**/terraform.tfstate', allowEmptyArchive: true
            junit '**/test-results/*.xml'

            // Clean up workspace after build
            cleanWs()
        }
    }
}

Other Infrastructure as Code (IaC) Languages

If you're looking to explore other languages for deploying you infrastructure into the cloud other than Terraform (although it's the best), then you can look at the table below:

Tool / Language	Short Summary
Terraform	Multi-cloud provisioning and management using HashiCorp Configuration Language (HCL).
AWS CloudFormation	Native AWS IaC tool using YAML/JSON templates for declarative resource provisioning in AWS.
Azure Resource Manager (ARM)	Azure-native JSON templates for deploying and configuring Azure resources.
Bicep	A higher-level DSL for Azure resource deployment that simplifies ARM templates.
Google Cloud Deployment Manager	Declarative IaC for GCP resources using YAML, Jinja2, or Python templates.
Pulumi	Provision infrastructure across multiple clouds using general-purpose languages (TypeScript, Python, Go, etc.).

Security Tools to Integrate into Cloud CI/CD Pipelines

If you're trying to figure out what cloud security tools you should use in your pipelines (or just locally), here are the list of resources I have outlined:

Tool Name	Description	Category
SonarQube	One of the most popular SAST tools, SonarQube analyzes code quality and security across multiple languages.	SAST
Semgrep	A fast and flexible static analysis tool for identifying security vulnerabilities in source code.	SAST
Bandit	Popular Python-focused SAST tool for identifying security issues in Python codebases.	SAST
OWASP Dependency-Check	A widely-used tool that checks for known vulnerabilities in project dependencies.	SAST
Snyk	A developer-first tool that scans for vulnerabilities in code, open-source dependencies, containers, and IaC.	SAST, Dependency Scanning, Container Security, and Cloud Security
OWASP ZAP	One of the most popular DAST tools, ZAP identifies security vulnerabilities in running web applications.	DAST
Arachni	A modular DAST scanner that is widely used for testing modern web applications.	DAST
Nikto	A highly popular DAST tool that scans web servers for vulnerabilities and misconfigurations.	DAST
Trivy	A comprehensive vulnerability scanner for containers and cloud-native applications.	Container & Cloud Security
Anchore Engine	Open-source tool for scanning container images for vulnerabilities and enforcing security policies.	Container Security
Clair	A popular open-source tool for scanning vulnerabilities in Docker and OCI container images.	Container Security

Additional Resources

To learn about more tools and such that you should use to help you build out your pipelines, check out this amazing resource created by Marek Šottl: Ultimate DevSecOps Library