Lesson 01 — DevSecOps Fundamentals

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 11 – DevSecOps & Infrastructure as Code (IaC) Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand DevOps and DevSecOps.
Explain the Secure Software Development Lifecycle (Secure SDLC).
Understand Shift Left Security.
Identify DevSecOps roles and responsibilities.
Design enterprise DevSecOps workflows.
Explain Continuous Integration and Continuous Delivery.
Build a security-first software delivery mindset.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate

Prerequisites: Module 10 – Backup, Disaster Recovery & Business Continuity

Hands-on Labs: Yes

💼 Business Scenario

CloudNova Technologies develops cloud-native applications for thousands of enterprise customers.

The company has:

350 Software Developers
60 DevOps Engineers
25 Cloud Security Engineers
Multiple Scrum Teams
Hundreds of Git Repositories
Production deployments every day

Historically, CloudNova followed a traditional software delivery process.

Unfortunately, recent security incidents exposed several weaknesses:

Developers committed AWS Access Keys to GitHub.
Terraform templates deployed public S3 buckets.
Vulnerable Docker images reached production.
Security reviews delayed every release.
Manual penetration testing found issues after deployment.
Production rollbacks increased significantly.

Management realised that security was being treated as the final checkpoint instead of being integrated throughout development.

The CTO asks:

“How can we deliver software faster while making security an automatic part of the development process?”

As the Cloud Security Engineer, your responsibility is to transform CloudNova into a modern DevSecOps organisation.

Why DevSecOps?

Modern software is released continuously.

Traditional security approaches cannot keep pace.

Without automation:

Developers wait for security reviews.
Security teams become bottlenecks.
Vulnerabilities reach production.
Releases become slower.

DevSecOps enables organisations to build security into every stage of software delivery.

What is DevOps?

DevOps combines Development and Operations to deliver software faster through collaboration and automation.

Traditional model:

Developers

↓

Throw code over the wall

↓

Operations

↓

Deploy

Problems:

Slow releases
Communication gaps
Manual deployments
Frequent failures

What is DevSecOps?

DevSecOps extends DevOps by integrating Security throughout the Software Development Lifecycle.

Instead of security occurring only before production, security becomes continuous.

Development

↓

Security

↓

Operations

↓

Continuous Delivery

Everyone shares responsibility for security.

Traditional Development Lifecycle

Requirements

↓

Development

↓

Testing

↓

Deployment

↓

Security Review

↓

Production

Problems:

Vulnerabilities discovered late.
Expensive remediation.
Delayed releases.
Increased business risk.

Modern Secure SDLC

CloudNova adopts a Secure Software Development Lifecycle.

Plan

↓

Design

↓

Develop

↓

Build

↓

Security Scan

↓

Testing

↓

Approval

↓

Deploy

↓

Monitor

↓

Improve

Security exists in every phase.

Shift Left Security

One of the most important DevSecOps principles is Shift Left Security.

Instead of finding vulnerabilities after deployment, they are identified much earlier.

Traditional

Production

← Security Testing

↓

DevSecOps

Planning

↓

Coding

↓

Build

↓

Security Testing

↓

Production

The earlier a vulnerability is found, the cheaper it is to fix.

Shared Responsibility

DevSecOps is a shared responsibility.

Team	Responsibilities
Developers	Secure code, peer reviews
DevOps Engineers	Secure CI/CD pipelines
Cloud Engineers	Secure infrastructure
Security Engineers	Security automation, policies
Operations	Monitoring and incident response
Leadership	Governance and compliance

Security is no longer owned by one team.

Enterprise DevSecOps Lifecycle

CloudNova follows this workflow.

Business Requirements

↓

Architecture

↓

Coding

↓

Git Repository

↓

Pull Request

↓

Automated Security Scans

↓

Build

↓

Testing

↓

Approval

↓

Deployment

↓

Monitoring

↓

Continuous Improvement

Continuous Integration (CI)

Continuous Integration automatically validates code after every change.

Typical CI activities:

Compile Code
Run Unit Tests
Static Code Analysis
Secret Detection
Dependency Scanning
Infrastructure Validation

Developers receive immediate feedback.

Continuous Delivery (CD)

Continuous Delivery automates software deployment.

Pipeline stages include:

Build

↓

Package

↓

Security Validation

↓

Deployment Approval

↓

Production Release

Every release should be:

Repeatable
Automated
Secure

DevSecOps Pipeline

Developer

↓

Git Commit

↓

Pull Request

↓

Code Review

↓

Static Code Analysis

↓

Secret Scanning

↓

Dependency Scan

↓

Infrastructure Scan

↓

Container Scan

↓

Build

↓

Testing

↓

Deployment

↓

Cloud Monitoring

Enterprise DevSecOps Architecture

                 Developers
                      │
             Git Repository
                      │
               Pull Request
                      │
              Code Review
                      │
              CI/CD Pipeline
                      │
      ┌───────────────┼────────────────┐
      │               │                │
 Secret Scan     SAST Scan      IaC Validation
      │               │                │
 Dependency      Container      Policy Check
   Scanning       Scanning
      │               │
      └───────────────┼────────────────┘
                      │
               Deployment Approval
                      │
                 AWS Production
                      │
 CloudWatch • CloudTrail • Security Hub

Security Gates

CloudNova prevents insecure software from reaching production.

Every deployment must pass:

✔ Code Review

✔ Unit Testing

✔ Static Code Analysis

✔ Secret Detection

✔ Dependency Scan

✔ IaC Scan

✔ Container Scan

✔ Compliance Validation

Only successful builds proceed to deployment.

Security Throughout the SDLC

SDLC Phase	Security Activity
Planning	Security Requirements
Design	Threat Modelling
Development	Secure Coding
Build	Static Code Analysis
Test	Vulnerability Assessment
Deploy	Security Validation
Operate	Monitoring
Improve	Lessons Learned

Common DevSecOps Tools

CloudNova uses the following tools.

Function	Example Tools
Source Control	GitHub, AWS CodeCommit
CI/CD	AWS CodePipeline, GitHub Actions
Build	AWS CodeBuild
Containers	Docker
Orchestration	Kubernetes, Amazon EKS
Infrastructure	Terraform, CloudFormation
Secrets	AWS Secrets Manager
Monitoring	CloudWatch
Security	Amazon Inspector, Security Hub

DevSecOps Culture

Technology alone does not create DevSecOps.

Successful organisations encourage:

Collaboration
Automation
Continuous Learning
Secure Coding
Frequent Feedback
Shared Ownership
Continuous Improvement

Enterprise Best Practices

CloudNova standards include:

Shift security left.
Automate every security check.
Treat infrastructure as code.
Never hardcode credentials.
Review every Pull Request.
Scan every dependency.
Secure every pipeline.
Continuously monitor production.
Train developers regularly.
Measure and improve continuously.

🛠 Lab 01 — Explore a CI/CD Pipeline

Objective:

Understand a modern DevSecOps pipeline.

Tasks:

Identify each pipeline stage.
Explain its purpose.
Determine where security checks occur.
Identify manual approval points.

Deliverable:

Pipeline workflow diagram.

🛠 Lab 02 — Secure SDLC Assessment

Review the following SDLC phases:

Planning
Design
Development
Testing
Deployment
Operations

For each phase identify:

Security Risks
Security Controls
Responsible Teams

🛠 Lab 03 — Identify Security Gates

Scenario:

A developer commits new application code.

Create a deployment checklist that includes:

Code Review
Unit Tests
Secret Scan
Dependency Scan
Infrastructure Scan
Container Scan
Security Approval

Explain why each gate is important.

🛠 Lab 04 — DevSecOps Team Responsibilities

Create a RACI matrix for:

Developers
DevOps
Security
Cloud Engineers
Operations

Document who is:

Responsible
Accountable
Consulted
Informed

💻 AWS CLI Lab

Verify your development environment.

Verify AWS CLI

aws --version

Verify Current Identity

aws sts get-caller-identity

List AWS Regions

aws ec2 describe-regions

List IAM Users

aws iam list-users

List IAM Roles

aws iam list-roles

List CodeCommit Repositories

aws codecommit list-repositories

(If using AWS CodeCommit in your environment.)

✅ Verification

Verify that you can:

✔ Explain DevSecOps.

✔ Differentiate DevOps from DevSecOps.

✔ Describe the Secure SDLC.

✔ Explain Shift Left Security.

✔ Identify security gates.

✔ Describe CI/CD workflows.

✔ Explain shared security responsibilities.

🔍 Troubleshooting

Problem

Developers bypass security reviews.

Verify:

Pull Request policies.
Branch protection rules.
Required approvals.
Automated security checks.

Problem

Security delays software releases.

Review:

Manual approvals.
Automated testing.
Pipeline optimisation.
Security tooling integration.

Problem

Credentials appear in source code.

Review:

Secret scanning.
Git history.
Developer training.
Secrets Manager usage.

🚫 Common Mistakes

❌ Treating security as the responsibility of only the security team.

❌ Performing security testing only before production.

❌ Skipping code reviews.

❌ Ignoring dependency vulnerabilities.

❌ Hardcoding credentials.

❌ Manual deployments.

❌ Not monitoring deployed applications.

🧪 DIY Challenge

CloudNova is launching a new cloud-native banking platform.

Design a secure DevSecOps workflow that includes:

Secure SDLC.
CI/CD Pipeline.
Security Gates.
Code Reviews.
Secret Management.
Automated Security Testing.
Deployment Approvals.
Continuous Monitoring.

Prepare:

DevSecOps Architecture
Secure SDLC Diagram
Pipeline Workflow
Team Responsibility Matrix
Security Control Checklist

📊 Knowledge Check

What is DevSecOps?
How does DevSecOps differ from traditional DevOps?
What is the Secure SDLC?
What is Shift Left Security?
Why is Continuous Integration important?
Why should security be automated?
What are security gates?
Why is shared responsibility important?
Which AWS services support DevSecOps?
Why should security be integrated into every stage of software development?

💡 Key Takeaways

After completing this lesson, you should understand:

DevSecOps integrates security into every stage of the Software Development Lifecycle rather than treating it as a final review.
Shift Left Security enables organisations to identify and fix vulnerabilities earlier, reducing cost and improving software quality.
Secure CI/CD pipelines rely on automated security gates such as code reviews, secret detection, dependency scanning and infrastructure validation.
DevSecOps is built on collaboration between developers, operations, cloud engineers and security teams, with shared ownership of application security.
Modern cloud organisations use automation, continuous monitoring and continuous improvement to deliver software rapidly without compromising security.

🚀 Next Lesson

➡️ Lesson 02 — Secure Infrastructure as Code (IaC)