AWS Cloud & DevOps Tutorial 0/70 lessons ~6 min read Lesson 61“IAM, VPC, EC2, Lambda, ECS, EKS, Terraform, CI/CD, and AWS operations”

Secure Software Supply Chain and DevSecOps

TechLearningPro already pins digests in ECR (lesson 19) and ships through CI/CD. Attackers still win through poisoned dependencies, unsigned images, unscanned bases, and pipelines

Course progress0%

Focus

15 guided sections

Practice signal

Examples included

Career prep

Interview Q&A included

Secure Software Supply Chain and DevSecOps

AWS Cloud & DevOps Engineering · Lesson 61 · Production Projects and Interview

Lesson Overview

TechLearningPro already pins digests in ECR (lesson 19) and ships through CI/CD. Attackers still win through poisoned dependencies, unsigned images, unscanned bases, and pipelines that promote on green unit tests alone. This lesson operationalizes secure software supply chain and DevSecOps: dependency and secret scanning, SBOM generation, image signing and provenance concepts, ECR scanning gates, IaC policy checks, and promotion rules that fail closed. You design a secure pipeline for the progress API without inventing AWS APIs—verify CodePipeline/CodeBuild, ECR enhanced scanning, Signer, and third-party tools against current docs when implementing.

Containers deepen in /learn/docker; cluster admission deepens in lesson 62 and /learn/kubernetes. Here the CI/CD and registry control plane is the focus. Tag lab resources Project=tlp-lesson61; budgets for build minutes, ECR storage, and scanning; cleanup images and pipelines when done.

Learning Objectives

Define software supply chain risks relevant to TechLearningPro container and Lambda artifacts.
Explain SBOM purpose and when to generate/store attestations.
Describe image signing and provenance at a conceptual level (e.g., Sigstore/Notation/AWS Signer—verify current offerings).
Place ECR scan results as mandatory promotion gates.
Add dependency scanning and secret scanning to pipelines.
Gate IaC with policy-as-code checks before apply.
Separate build, scan, sign, and deploy roles with least privilege.
Forbid floating latest tags in production promotion.
Design break-glass for critical CVE exceptions with expiry and ADR.
Map evidence to auditors: who built, what digests, which gates passed.
Avoid storing secrets in Docker layers or build logs.
Connect to ECS task defs and EKS GitOps digest pins.
Estimate pipeline cost drivers (build minutes, scanner, registry).
Prepare interview answers on DevSecOps vs bolting scanners on at the end.
Cross-link Docker/Kubernetes courses without cloning them.
Produce a secure pipeline design pack for progress API.
Test negative path: critical CVE blocks promote.
Test negative path: secret in commit fails pipeline.
Document cleanup of lab repos, images, and signer resources.
Hand off to EKS GitOps ops in lesson 62.

Prerequisites

Amazon ECR and Container Image Supply Chain.
AWS CodeBuild and CodePipeline.
Containers with Docker for AWS Workloads and /learn/docker.
IAM least privilege and Secrets Manager awareness.
Sandbox + budget for ECR and CodeBuild-style builds.

Detailed Core Concepts

Supply chain threat model (TechLearningPro)

Threats: malicious npm/maven/pypi dependency; compromised base image; CI role overprivilege pushing directly to prod; secret leaked into image layer; unsigned digest replaced in registry; IaC that opens 0.0.0.0/0 SSH. Controls map to: dependency scan, Dockerfile hygiene, ECR scan, signature/provenance verification, least-privilege push/pull, secret scan, policy-as-code on Terraform/CloudFormation, digest-pinned deploys.

SBOM

A Software Bill of Materials lists packages and versions inside an artifact. When a CVE drops, SBOM shortens “are we affected?” Generate at build time; store beside digest (registry OCI referrers or artifact store—verify current ECR/feature support). SBOMs without process to query them are shelfware.

Scanning layers

Source/dep scan — lockfiles, CVE databases, license policy.
Secret scan — pre-commit + CI; block keys/tokens.
Image scan — ECR basic/enhanced scanning (confirm enablement model in current docs); gate on severity.
IaC scan — misconfiguration before apply.
Runtime — separate; do not pretend build scan replaces runtime detection.

Signing and provenance

Signing binds identity to digest. Provenance attests how/where built (SLSA-style ideas). Admission or deploy steps verify signature before run. Exact AWS Signer integrations and third-party options evolve—design the control (verify before promote) and verify implementation docs at build time. Never invent CLI flags.

Pipeline gates (fail closed)

Order example: lint → tests → dep scan → build image → ECR push by digest → ECR scan wait → sign → staging deploy → soak → prod deploy same digest. Any critical gate failure stops promote. Exceptions require ticket + expiry + compensating control.

ECR promotion discipline (recap + harden)

Lesson 19 required digests and scan awareness. Here: production clusters/services may only pull signed digests that passed scan policy; mutable latest forbidden; lifecycle retains rollback digests for the SLO window.

DevSecOps culture

Security is pipeline design, not a weekend scanner install. Platform owns paved path; app teams consume. Metrics: time-to-patch critical base images, percent releases with SBOM+signature, exception aging.

Architecture and Design Diagrams

mermaid
flowchart LR
  Dev[Developer PR]
  CI[CI build]
  Dep[Dep + secret scan]
  Img[Build image]
  ECR[ECR digest]
  Scan[ECR scan gate]
  Sign[Sign / attest]
  Stg[Staging]
  Prod[Production]

  Dev --> CI --> Dep --> Img --> ECR --> Scan --> Sign --> Stg --> Prod

mermaid
flowchart TB
  Policy[Promotion policy]
  SBOM[SBOM store]
  Sig[Signature verify]
  Adm[Deploy / admission]
  Policy --> Adm
  SBOM --> Adm
  Sig --> Adm

Technical Explanation

How TechLearningPro promotes progress-api

CI OIDC assumes tlp-ci-progress-build. Build produces digest sha256:…. Push to ECR staging repo. Enhanced/basic scanning results evaluated by a gate (CodeBuild step, Lambda check, or pipeline condition—implement with documented APIs only). On pass, signer attests. GitOps or ECS registers the digest. Production role can pull only from prod repository or verified digests—no human docker push from laptops to prod.

Exception handling

Critical CVE in base image with no fix: platform may accept risk for N days with WAF/segment compensating controls, tracked in ticket, ADR note, auto-expiry. Silent “continue on error” is forbidden.

Secrets in builds

Build-time secrets via Secrets Manager or OIDC-federated package registries—not ARG PASSWORD baked into layers. Scrub CI logs. Lesson 60 key hygiene applies to pipeline roles.

IaC gates

terraform plan piped to policy checks (e.g., open SG detection). Fail PR if SSH open to world. Same for CloudFormation/cfn-nag style tools—choose tooling consciously; document versions.

Relation to EKS

Admission controllers / policy engines can verify signatures at deploy time (lesson 62). Supply chain starts earlier—admission without scan/sign still allows bad digests that somehow entered git.

Extended depth: gate table template for TechLearningPro progress-api

Stage	Control	Fail closed?	Evidence
PR	secret scan + lint	yes	CI log
Build	dep scan on lockfile	yes for critical	report artifact
Image	ECR scan on digest	yes for critical/high policy	scan API/UI
Sign	signer attestation	yes in prod path	signature verify log
IaC	policy on plan	yes for open-SSH class findings	policy report
Deploy staging	digest pin	yes	manifest SHA
Deploy prod	same digest + verify	yes	change ticket

Fill this table in your lab; do not invent severity enum names—use what your scanner documents.

Extended depth: break-glass narrative

Exam-week hotfix needs a base image with a medium CVE that policy treats as blocking. Platform opens a 7-day waiver with WAF rate limits and elevated runtime detection, rebuilds scheduled on day 5, ADR records acceptance. Day 8 auto-ticket if still open. That is DevSecOps maturity; silent continue-on-error is not.

Extended depth: what not to clone from other courses

/learn/docker teaches Dockerfile craft; /learn/kubernetes teaches admission webhooks in depth. This lesson owns the AWS delivery gates and evidence pack. Cross-link; do not paste those curricula here.

Practical Implementation or Design Walkthrough

Problem

Design a secure pipeline with dependency, image, and IaC checks for TechLearningPro progress API.

Steps

Budget on; create or sketch ECR repo with scan settings on push (verify console/API).
Document pipeline stages and fail-closed gates in Markdown.
Add dependency scan + secret scan steps (tool choice documented; versions pinned).
Build/push a sample image; record digest; show scan findings UI/API evidence.
Negative test: introduce a deliberate secret in a branch; prove CI fails (do not push real secrets).
Negative test: policy that blocks CRITICAL severity; demonstrate block or document how.
Sketch signing verification step; note which product you’ll verify in docs—no fake flags.
Write ADR on exception process.
Tag resources Project=tlp-lesson61; cleanup images/repos/pipelines.
Deliver pipeline diagram + gate table + evidence.

Enterprise Real-World Scenarios

Scanner optional

Critical CVE shipped Friday. Fix: fail closed; exception bus with expiry.

latest in prod

Node reboot pulled bad build. Fix: digest pins + immutable tags.

Laptop push to prod ECR

No provenance. Fix: deny human prod push; CI only.

SBOM never queried

CVE response takes days. Fix: SBOM storage + query runbook.

IaC after apply

Open SG in prod hours. Fix: policy gate on plan.

Best Practices

Fail closed on critical gates.
Digest-only production deploys.
SBOM per release artifact.
Sign and verify before prod.
Secret scanning in CI and pre-commit.
Least privilege CI roles.
Exception tickets with expiry.
IaC policy before apply.
Retain digests for rollback SLO.
Separate build and deploy roles.
Pin tool versions in CI.
Redact build logs.
Budget build and storage.
Evidence pack for auditors.
Cleanup lab images.

Common Mistakes and Anti-Patterns

continue-on-error for scanners.
Floating latest in prod.
Secrets as Docker ARG persisted.
Inventing signer CLI flags.
Same role builds and prod-admin.
Ignoring base image drift.
Manual prod push 'just once'.
SBOM generated never stored.
Policy exceptions forever.
Skipping IaC scans for speed.

Troubleshooting and Design Review

Symptom	Cause	Action
Gate never trips	Severity thresholds too high	Tune policy; test with known finding
Scan not ready	Race before results	Wait/poll documented scan status APIs
Signature verify fails	Wrong identity/trust root	Align signer profile and admission trust
CI can push prod	Overwide IAM	Split roles; repo policies
Secret in history	Committed key	Rotate; rewrite/purge per process; block
Slow pipelines	Uncached builds	Layer cache; narrow scan scope thoughtfully

Interview Questions and Answers

Q1: DevSecOps meaning? A: Security controls in the delivery path, fail closed. Q2: SBOM? A: Inventory of components for CVE response. Q3: Why digests? A: Immutable reference to bytes. Q4: ECR scan gate? A: Block promote on policy-violating findings. Q5: Signing purpose? A: Prove who produced digest; enable verify. Q6: Exception process? A: Time-bounded accepted risk with owners. Q7: Secret scan when? A: Pre-commit and CI; rotate on fail. Q8: IaC scanning? A: Catch misconfig before apply. Q9: latest risk? A: Mutable unexpected bytes. Q10: Build vs deploy roles? A: Reduce blast radius. Q11: Provenance? A: Attests build parameters/source. Q12: Link to ECR lesson? A: Foundation; this adds gates/sign/SBOM. Q13: K8s admission? A: Verify at deploy; not a substitute for CI gates. Q14: Metric? A: Exception age; % signed releases. Q15: Next? A: EKS GitOps ops consuming signed digests.

Hands-On Exercises

Exercise: Secure pipeline design with dep, image, IaC checks

Deliverable: gate table, Mermaid pipeline, ECR scan evidence, negative secret-scan test, ADR exception process, Project=tlp-lesson61 cleanup.

Challenge ADR

Require signature verification before production for progress-api within one quarter; staging may run unsigned during migration with explicit risk.

Lab evidence checklist

Digest; scan screenshot/API; CI log redacted; IAM role sketch; destroy images.

Narrative: gate stops Monday fire

A transitive CVE hit the progress base image; scan gate blocked promote Friday; platform rebuilt on patched base; Monday board stayed up.

Continuity

Next consume signed digests on EKS: Kubernetes Operations and GitOps on EKS. Deepen containers at /learn/docker.

Extended practice scenario 1 — 61 secure software supply chain and devsecops

Confirm AWS Budgets alerts exist for the sandbox; tag every resource Project=tlp-lesson61. Do not proceed without a budget subscriber.

In a timed drill for secure software supply chain and DevSecOps at TechLearningPro, implement or design the core lab with a partner observing. The observer's job is to stop any step that invents API flags, hardcodes secrets, invents pricing numbers presented as current quotes, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: pipeline diagram, gate table, digest+scan evidence, secret-scan failure proof, ADR, and destroy confirmation for any lab resources.

Discuss how secure software supply chain and DevSecOps connects prior AWS lessons (IAM, VPC, EC2/SSM, CI/CD, observability, FinOps) and upcoming Module 6 projects. List two supply-chain risks for Project 2 (containers) with owners and dates.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards. Premium courses finish when you can operate under time pressure without treating secure software supply chain and DevSecOps as a mystery.

Extended practice scenario 2 — 61 secure software supply chain and devsecops

Document the lesson's primary architecture decision in a ten-line ADR: context, decision, status, consequences.

Extended practice scenario 3 — 61 secure software supply chain and devsecops

Map identity paths: who can create/modify the resources in this lesson; which IAM roles are least privilege.

Extended practice scenario 4 — 61 secure software supply chain and devsecops

Design observability: CloudWatch metrics/alarms or equivalent signals that prove the control works.

Extended practice scenario 5 — 61 secure software supply chain and devsecops

Run or design a negative test: denied access, misconfiguration, or failed dependency—capture evidence.

Extended practice scenario 6 — 61 secure software supply chain and devsecops

Estimate cost dimensions for this lesson's activities. Label figures illustrative; verify pricing pages with dates.

Extended practice scenario 7 — 61 secure software supply chain and devsecops

Produce a cleanup checklist and execute destroy for any billable lab resources created for this lesson.

Extended practice scenario 8 — 61 secure software supply chain and devsecops

Cross-link prior course lessons that this design depends on; list two failure modes inherited from those layers.

Extended practice scenario 9 — 61 secure software supply chain and devsecops

Security review: encryption at rest/in transit, public exposure checks, CloudTrail visibility for management events.

Extended practice scenario 10 — 61 secure software supply chain and devsecops

Reliability review: failure isolation, rollback, how detection and recovery work under Monday traffic.

Extended practice scenario 11 — 61 secure software supply chain and devsecops

Performance review: bottlenecks, scaling limits, or saturation signals relevant to this lesson's topic.

Extended practice scenario 12 — 61 secure software supply chain and devsecops

Write a runbook section for on-call: symptoms, first three diagnostic steps, escalation, rollback.

Extended practice scenario 13 — 61 secure software supply chain and devsecops

Config/compliance angle: which controls must be true before production promotion.

Extended practice scenario 14 — 61 secure software supply chain and devsecops

Multi-account consideration: how this control behaves across sandbox, staging, and production accounts.

Extended practice scenario 15 — 61 secure software supply chain and devsecops

Interview drill: explain the lesson topic to a hiring manager in three minutes without inventing APIs.

Extended practice scenario 16 — 61 secure software supply chain and devsecops

Pair review: partner stops any invented CLI flags, hardcoded secrets, or fake current prices.

Extended practice scenario 17 — 61 secure software supply chain and devsecops

FinOps continuity from lesson 47: idle resources, data transfer, and when to decommission lab stacks.

Extended practice scenario 18 — 61 secure software supply chain and devsecops

DR continuity from lesson 45: ensure this design does not destroy recoverability during change.

Extended practice scenario 19 — 61 secure software supply chain and devsecops

Produce evidence pack: diagrams, configs, test results, cleanup proof.

Extended practice scenario 20 — 61 secure software supply chain and devsecops

Challenge constraint: tighter monthly budget—what do you sequence differently?

Extended practice scenario 21 — 61 secure software supply chain and devsecops

Challenge constraint: stricter compliance—what evidence gates release?

Extended practice scenario 22 — 61 secure software supply chain and devsecops

Challenge constraint: shorter maintenance window—what pre-staging changes?

Extended practice scenario 23 — 61 secure software supply chain and devsecops

Teach-back: recite the Lesson Overview paragraph, then check against the text; flashcard gaps.

Extended practice scenario 24 — 61 secure software supply chain and devsecops

Dress rehearsal: tabletop under a timer with observer notes.

Extended practice scenario 25 — 61 secure software supply chain and devsecops

Final synthesis note: one paragraph connecting this lesson's topic to TechLearningPro production ownership.

Compliance evidence pack for auditors / platform leads

Budget configs, tagging proof (Project=tlp-lesson61), architecture diagram, ADR, negative-test evidence, encryption settings notes, CloudTrail/Config/SSM references where applicable, pricing-page retrieval dates for any dollar claims, cleanup confirmation.

Glossary drill

Define SBOM, digest, provenance, fail closed, ECR scanning, policy-as-code from memory.

Budget and cleanup sworn statement

I verified budgets remain enabled with alert subscribers. I deleted or scheduled deletion for orphan lab resources from lesson 61 named ____. I labeled every savings or cost figure with pricing-page retrieval dates or marked it illustrative. Signed ________ date ________.

Interview story to memorize

Craft a 60-second story: you failed closed on ECR critical findings, pinned digests, added SBOM+signing design, and killed laptop pushes to prod.

Self-assessment rubric

Area	Weight
Conceptual accuracy and service selection	20%
Working design/lab and reproducibility	25%
Security and least-privilege	20%
Reliability, observability, troubleshooting	20%
Documentation, ADR, cleanup	15%

Final synthesis before summary

Supply chain mastery is proven gates and digests—not scanner logos. TechLearningPro ships only what policy can verify.

Extended facilitation script (print for guild leads)

Open with a hypothetical poisoned dependency. Walk the pipeline stages asking where it should have died. Assign owners for scan policy thresholds and for deleting Project=tlp-lesson61 lab images tonight.

Lesson Summary

DevSecOps for TechLearningPro binds dependency/secret/IaC scans, ECR scan gates, SBOM, and signing/verification into fail-closed promotion of digests—never latest, never laptop prod pushes. Tag Project=tlp-lesson61; budget and cleanup. Next: Kubernetes Operations and GitOps on EKS.

Secure Software Supply Chain and DevSecOps

Secure Software Supply Chain and DevSecOps

Lesson Overview

Learning Objectives

Prerequisites

Detailed Core Concepts

Supply chain threat model (TechLearningPro)

SBOM

Scanning layers

Signing and provenance

Pipeline gates (fail closed)

ECR promotion discipline (recap + harden)

DevSecOps culture

Architecture and Design Diagrams

Technical Explanation

How TechLearningPro promotes progress-api

Exception handling

Secrets in builds

IaC gates

Relation to EKS

Extended depth: gate table template for TechLearningPro progress-api

Extended depth: break-glass narrative

Extended depth: what not to clone from other courses

Practical Implementation or Design Walkthrough

Problem

Steps

Enterprise Real-World Scenarios

Scanner optional

latest in prod

Laptop push to prod ECR

SBOM never queried

IaC after apply

Best Practices

Common Mistakes and Anti-Patterns

Troubleshooting and Design Review

Interview Questions and Answers

Hands-On Exercises

Exercise: Secure pipeline design with dep, image, IaC checks

Challenge ADR

Lab evidence checklist

Narrative: gate stops Monday fire

Continuity

Extended practice scenario 1 — 61 secure software supply chain and devsecops

Extended practice scenario 2 — 61 secure software supply chain and devsecops

Extended practice scenario 3 — 61 secure software supply chain and devsecops

Extended practice scenario 4 — 61 secure software supply chain and devsecops

Extended practice scenario 5 — 61 secure software supply chain and devsecops

Extended practice scenario 6 — 61 secure software supply chain and devsecops

Extended practice scenario 7 — 61 secure software supply chain and devsecops

Extended practice scenario 8 — 61 secure software supply chain and devsecops

Extended practice scenario 9 — 61 secure software supply chain and devsecops

Extended practice scenario 10 — 61 secure software supply chain and devsecops

Extended practice scenario 11 — 61 secure software supply chain and devsecops

Extended practice scenario 12 — 61 secure software supply chain and devsecops

Extended practice scenario 13 — 61 secure software supply chain and devsecops

Extended practice scenario 14 — 61 secure software supply chain and devsecops

Extended practice scenario 15 — 61 secure software supply chain and devsecops

Extended practice scenario 16 — 61 secure software supply chain and devsecops

Extended practice scenario 17 — 61 secure software supply chain and devsecops

Extended practice scenario 18 — 61 secure software supply chain and devsecops

Extended practice scenario 19 — 61 secure software supply chain and devsecops

Extended practice scenario 20 — 61 secure software supply chain and devsecops

Extended practice scenario 21 — 61 secure software supply chain and devsecops

Extended practice scenario 22 — 61 secure software supply chain and devsecops

Extended practice scenario 23 — 61 secure software supply chain and devsecops

Extended practice scenario 24 — 61 secure software supply chain and devsecops

Extended practice scenario 25 — 61 secure software supply chain and devsecops

Compliance evidence pack for auditors / platform leads

Glossary drill

Budget and cleanup sworn statement

Interview story to memorize

Self-assessment rubric

Final synthesis before summary

Extended facilitation script (print for guild leads)

Lesson Summary

Further Reading