Shifting Left with the CrowdStrike and AWS CI/CD Pipeline

Introduction

CI/CD combines the practices of continuous integration (CI) and Continuous Delivery (CD) to allow DevOps teams to deliver code updates frequently, reliably, and quickly. CI/CD emphasizes automation throughout the development lifecycle (Build, Test, Deploy). By replacing the manual efforts of traditional development, code releases can happen more frequently, and with less bugs and security vulnerabilities.

At CrowdStrike, we focus on integrating security into the CI/CD pipeline. As part of the functionality of CrowdStrike’s Falcon Cloud Workload Protection (CWP), customers have the ability to create verified image policies to ensure that only approved images are allowed to progress through the CI/CD pipeline and run in their hosts or Kubernetes clusters.

Lab Environment

Let’s take a look at the steps involved in setting up the environment.

Step 1. Developer commits the code to the repository.

Step 2. The CodeCommit repo has the code to

• build the container
• scan the image
• Install the Falcon sensor
• Push image to ECR

Step 3. CodeBuild compiles the code and also scans it for vulnerabilities.

Step 4. If there are vulnerabilities found in the image, CodeBuild sends the scan report to the Falcon UI.

The role of CodePipeline in all of this is to automate the steps required to release the software changes continuously.

Demo

All the code is stored in the CodeCommit “webapp” Repository. The webapp repo has a collection of folders and buildspec files. Buildspec stands for Build Specification. A buildspec is a collection of build commands and related settings, in YAML format, that CodeBuild uses to run a build. The Full Project is available on the CrowdStrike GitHub.

CodeBuild compiles the code and scans for vulnerabilities

Scenario 1 – Vulnerabilities detected

The webapp build failed as the code had vulnerabilities

Scenario 2 – Vulnerabilities not detected

The webapp build passed as the code had no vulnerabilities.