Continuous Integration/Continuous Delivery – An important concept to consider when enhancing your existing SDLC is Continuous Integration/Continuous Delivery or Deployment (CI/CD). These processes involve securing your application code repositories and automating events following a PR (Pull Request) to a designated branch in the repository. These processes remove unnecessary manual interventions – leading to faster code builds and releases, more secure and efficient application configurations, and a smoother experience for your developers and end-users. Dependent upon your organization’s needs for automating your existing SDLC, AWS provides services for every stage in the process.

AWS Code Commit – Starting with an application’s source code, AWS CodeCommit is a fully managed source control service that securely hosts your Git repositories. This allows your teams to collaborate securely with each other without needing to worry about managing a source control system. Within the application code itself, AWS provides Software Development Kits (SDKs) for many programming languages that allow secure, programmatic access to AWS services – with the ability to securely store sensitive credentials via AWS Secrets Manager or AWS Systems Manager Parameter Store based on your organization’s specific needs. CodeCommit can also import repositories from any Git-based repository and integrate with dozens of other AWS and third-party services seamlessly.

AWS Code Build – To automate the build and test phases of the SDLC for your cloud applications, AWS provides CodeBuild – a fully managed Continuous Integration (CI) service that compiles source code, runs unit and integration tests, and configures artifacts that can be used to deploy the application or used in further SDLC processes. With CodeBuild, organizations can make use of the many default build environments for many popular programming languages or configure custom build environments to fit the needs of your project. CodeBuild also seamlessly integrates with many other AWS Services like S3 to automatically store build artifacts, or CloudWatch to notify individuals about the status of builds.

AWS CodeDeploy – Now that your application is built, tested, and an artifact is made available – you can automatically deploy your application using the artifact according to configurations you can customize with AWS CodeDeploy. CodeDeploy is a Continuous Deployment (CD) service that fully automates application deployments to Amazon EC2, ECS, Lambda, and even on-premises servers based on programmed configurations. CodeDeploy has different deployment methods at your disposal such as an In-Place deployment (deploying the application directly to the specified instances) or a Blue-Green deployment (creating a new green environment to deploy the application to without effecting current instances) — with different deployment configurations that allow you to specify how the application is deployed (All-at-once, Half-at-a-time, Canary, etc.).

AWS CodePipline – What if automating the entire SDLC is something that does not work within your company’s current processes? If there is a need for manual intervention before the application gets fully deployed, consider leveraging a service like AWS CodePipeline. CodePipeline is a Continuous Delivery (CD) service that is used to automate specific stages of the SDLC that best fit your company’s needs. For example, if there is further testing that needs to be done on the artifact once it is generated by a build service like AWS CodeBuild, you can add a stage for manual intervention before CodeDeploy imports the artifact to conduct further testing or review. If your company already utilizes a third-party service for any other aspect of the SDLC (Jenkins, Chef, etc.) — CodePipeline integrates seamlessly with many popular third-party services to allow streamlining of processes outside of AWS.

To automate the different phases of operations in DevSecOps, we can use Infrastructure as Code (IaC), which allows infrastructure to be created, managed, and versioned as if it were software. This unlocks many benefits for your organization including increased update speed, seamless rollbacks, reusability, collaboration, and consistency.

AWS CloudFormation – AWS offers a fully managed IaC service called CloudFormation, allowing your organization to build and manage your cloud environments in a predictable and secure manner. CloudFormation makes use of a concept called a Stack that contains templates defining infrastructure resources in a declarative manner. Stacks can be created, deleted, or updated in the form of ChangeSets. If your organization makes use of AWS Organizations, CloudFormation StackSets enable you to manage resources across multiple AWS accounts and regions with a single click.

Observability through AWS

Achieving observability of your cloud applications through monitoring tools and technology is a critical practice for your organization. Some immediate benefits include an optimized security posture of your systems in AWS and improved ability to deliver secure software and services to end users faster. AWS provides many observability services such as AWS Config, CloudWatch, CloudTrail, X-Ray, and more.

AWS Config – AWS Config is a service that continuously monitors and analyzes your resources, keeping track of all changes made to them, and provides a complete historical record of configuration changes – which can be easily accessed for use in audits, or to provide compliance to internal policies/regulatory standards.

AWS CloudWatch – Amazon CloudWatch monitors your AWS resources and applications running in the cloud, providing real-time data and operational insights. Your organization can use these insights to optimize application performance using default or custom metrics — all while keeping costs easily manageable. CloudWatch can also integrate with many other AWS services such as Lambda to schedule actions such as scaling resources based on certain thresholds and/or SNS to send notifications.

AWS CloudTrail – To provide clear visibility into actions taken within your AWS Accounts, you can leverage AWS CloudTrail – a service that enables governance, compliance, and operational/risk auditing. Events logged by CloudTrail such as actions taken through the AWS Management Console, AWS CLI, SDKs, and others are easily accessible to simplify actions like detecting unusual account activity or troubleshooting operational errors.

AWS X-Ray – AWS X-Ray is a development tool used to simplify the troubleshooting process of distributed applications, I.e., microservices. Analyzing and debugging a distributed application can be challenging due to the complexity of the application’s architecture, especially when it comes to finding the source of a bug as these systems can run multiple servers across multiple Availability Zones and/or Regions. With X-Ray, you can trace requests as they flow through the entirety of the application (across multiple different services both within the AWS platform and outside via third-party APIs). This provides a comprehensive view of the request and response data — helping your team identify and fix performance issues more effectively.

Incident Response with AWS

Another critical aspect of any cloud environment is incident response. An incident is defined as anything that takes a production application down from service or data being exposed to a non-trusted entity. The goal of incident response is to minimize the impact of the incident, restore normal operations as quickly as possible, and prevent future incidents from occurring. AWS offers a suite of services to fit your organization’s incident response and disaster recovery needs.

AWS Backup – AWS Backup provides a way to centralize and automate backups across many AWS resources including EBS Volumes, RDS Databases, and DynamoDB Tables. These backups can be quickly and automatically restored to production in case of an incident.

AWS resources can be deployed across multiple Regions and Availability Zones to enable resiliency. Each Region is geographically separated from other Regions, and each Region consists of multiple Availability Zones. Many AWS services, including EC2 and RDS, offer multi-AZ capabilities to prevent outages caused by an Availability Zone outage. A full copy of production infrastructure can be easily set up in another Region for disaster recovery using CloudFormation.

As an AWS Advanced Consulting Partner, Infinitive has vast expertise and experience implementing best practice, AWS DevSecOps environments for our clients. Integrating security into your SDLC from the start and leveraging AWS services that accommodate your organization’s needs can effectively foster a DevSecOps culture and deliver products to customers securely and efficiently. For more information on how Infinitive can help you promote a DevSecOps culture in your organization and hear how we have driven clients to success — contact us today!