Failing a Risky Deployment Through Governance Controls

Table of Contents

1. Challenge

   Verify AWS resources were deployed and locally clone the repository files

   Before you begin implementing a compliant change, you need to verify that the resources were deployed, and you need to clone the repository files locally.

   • Within CloudShell (or your local IDE) clone the repo. listed in the lab's Additional Resources section.
   • Verify the pre-existing resources were deployed in AWS
     • Amazon S3 bucket (starts with governance-lab-artifacts-)
     • AWS CodePipeline (governance-pipeline) with four stages:
       • Source
       • GovernanceLint
       • GovernanceGuard
       • Deploy
     • AWS CloudFormation stack (governance-lab-deploy)
2. Challenge

   Explore the cfn-guard rule files

   Now that you've verified the required resources have been deployed and you have cloned the repository files, you will want to now read through the different provided guard files so that you can understand what is being prevented within the governance pipeline.

   • Navigate the lab cfn-guard directory within the cloned repository: 7-lab-failing-a-risky-deployment-through-governance-controls/cfn-guard
   • Inspect and read through the different guard files, leveraging the README.md file to gain an understanding of what each guard file does.
   • Choose an existing resource to update or a new resource to add to the infra/template.yml CloudFormation template file.
     • Recommended resources:
       • Amazon S3 bucket
       • AWS IAM role
       • AWS IAM policy
       • VPC security group
3. Challenge

   Update the CloudFormation template and trigger the pipeline

   Now that you have an understanding of the guard rules that are in place and you've chosen the AWS resource you want to either add or update, you can now create an updated artifacts.zip file and trigger your pipeline.

   • Edit the infra/template.yml cfn template file within the lab directory (7-lab-failing-a-risky-deployment-through-governance-controls
   • Add your new resource, or update an existing resource.
   • Create an updated artifacts.zip file containing the updated files and directories
   • Upload the new file to the Amazon S3 artifacts bucket in your account
   • Once the upload is successful, navigate to your AWS CodePipeline and wait for governance-pipeline to run and fail
4. Challenge

   Inspect the AWS CodePipeline build logs

   After your pipeline has failed, you will need to investigate the log files for the build that failed so you can identify the location of the error.

   • Select your governance-pipeline within AWS Code Pipeline
   • Once the pipeline is done executing, view the GovernanceGuard stage build logs.
   • Find and identify the cfn-guard rules that failed as well as the resource that triggered the failure.