- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
Using Static Analysis to Detect CloudFormation Misconfigurations
In this lab, you will learn how to enforce governance in your infrastructure-as-code pipeline by integrating the `cfn-lint` tool to detect CloudFormation template issues. You will configure buildspec commands to run static analysis in a pre-existing governance stage within your pipeline. By implementing the tools in this lab, you will be able to identify and catch misconfigurations within your pipeline automatically and block the non-compliant templates from being deployed. **Important Information**: Please ensure that you read through the **Additional Information** section.
Lab Info
Table of Contents
-
Challenge
Introduce a compliant template
Download the repository files and edit the existing
infra/template.ymlfile.-
Clone the repository locally from the repo URL: https://github.com/pluralsight-cloud/Path-Proactive-Security-in-Your-AWS-CI-CD-Pipeline.git
-
Edit the
infra/template.ymlfile within the lab-specific directory (4-lab-using-static-analysis-to-detect-cloudformation-misconfigurations) -
Within the
infra/template.ymlfile add a new IAM role below the existing VPC security group resource.- Role Name:
governance-lab-test-role - There will be some other settings**: This is up to you. The supplied example within the repository files and lab guide will allow s3:GetObject, s3:ListBucket, and s3:PutObject permissions on the artifacts S3 bucket.
- Role Name:
-
-
Challenge
Validate locally
Install
cfn-lintlocally and validate your cfn template.- Install
cfn-lint,boto3, andpyyamlusing pip - Execute
cfn-lintagainst your updatedinfra/template.ymlfile locally - Validate your
infra/template.ymlpasses throughcfn-lintwithout any warnings
- Install
-
Challenge
Update the CodeBuild configuration
Now that your templates are validated, you need to update the
buildspec.ymlfile.- Edit the
configuration/buildspec.ymlwithin the lab-specific directory (4-lab-using-static-analysis-to-detect-cloudformation-misconfigurations) - Within the
installphase of theconfiguration/buildspec.ymlfile, installcfn-lint,boto3, andpyyamlusing pip - Within the
buildphase of theconfiguration/buildspec.ymlfile, check thecfn-lintversion, and runcfn-lintagainst all .yml files within theinfra/directory - Leave the
artifactsportion of theconfiguration/buildspec.ymlfile as-is
- Edit the
-
Challenge
Verify the buildspec change reached CodeBuild
Now that all of your artifact files are ready, you can update the pipeline by uploading the
artifacts.zipfile to your Amazon S3 bucket to trigger a build.- Zip up all of the required files into an
artifacts.zipfile - Upload the
artifacts.zipfile to the Amazon S3 artifacts bucket in your account - Validate the governance-pipeline pipeline executes successfully and deploys your new cfn template
- Inspect the build logs for the GovernanceLint stage
- Inspect the deploy logs for the Deploy stage
- Zip up all of the required files into an
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.