Running a Compliant Governance Check in an AWS Pipeline

Table of Contents

1. Challenge

   Verify AWS resources were deployed and locally clone the repository files

   Before you begin implementing a compliant change, you need to verify that the resources were deployed, and you need to clone the repository files locally.

   • Within CloudShell (or your local IDE) clone the repo. listed in the lab's Additional Resources seciton.
   • Verify the pre-existing resources were deployed in AWS
     • Amazon S3 bucket (starts with governance-lab-artifacts-)
     • AWS CodePipeline (governance-pipeline) with four stages:
       • Source
       • GovernanceLint
       • GovernanceGuard
       • Deploy
     • AWS CloudFormation stack (governance-lab-deploy)
2. Challenge

   Trigger a new pipeline build

   Now that you’ve verified the required resources have been deployed and you have cloned the repository files, you can create your artifacts.zip file and upload it to trigger a pipeline build.

   • Recursively zip up all of the required files into an artifacts.zip file.
   • Upload the artifacts.zip file to your Amazon S3 artifacts bucket.
   • Ensure that your governance-pipeline is executing a new build.
     • The pipeline should fail.
3. Challenge

   Inspect the AWS CodePipeline build logs

   After your pipeline has failed, you will need to investigate the log files for the build that failed so you can identify the location of the error.

   • Find the failed stage within your governance-pipeline.
   • Within the failed stage action, investigate the build logs.
   • Search within the build logs to find the FAILED rule, as well as the associated resource that triggered it.
   • Make note of both the line and the resource that caused the failure.
4. Challenge

   Update and fix the template file

   After you have identified which resource triggered the failure for the guard rule, you need to correct the template and prepare it for a new deployment.

   • Edit the infra/template.yml cfn template file.
     • Navigate to the resource that was causing the error and fix the resource properties causing the failure.
   • Write and save the file.
5. Challenge

   Create the new artifacts.zip and trigger the pipeline

   With the template in place, you can now create an updated artifacts.zip file and upload it to your S3 bucket to trigger your pipeline.

   • Create an updated artifacts.zip file containing the updated files.
   • Upload the new artifacts.zip file to the Amazon S3 bucket in your account.
   • Select your governance-pipeline within AWS Code Pipeline
   • For the pipeline to successfully complete.
   • Once the pipeline is done executing, view the deploy stages output summary.
   • Verify the new AWS CloudFormation template was deployed and the new resource exists