Case study · DevSecOps

Building a Secure DevSecOps Pipeline on AWS

• Industry: Enterprise messaging & mobility services
• Focus area: DevSecOps, CI/CD automation, application security
• Platform: Amazon Web Services

A business-critical web application ran reliably on Amazon EC2 behind a load balancer, but the path from commit to production had not kept pace with the business. Releases depended on manual steps, and security validation happened late — often only after code was already live. We rebuilt the delivery process around a DevSecOps CI/CD pipeline on AWS, embedding security checks into every stage of the release lifecycle instead of bolting them on at the end.

The challenge

Code moved to EC2 with very little pre-deployment security validation, and the open-source libraries the application depended on were never scanned automatically for known vulnerabilities. Runtime security issues surfaced only once the application was already serving traffic — the most expensive point at which to find them.

Deployments were carried out manually, introducing missed steps, inconsistent configuration, and no reliable way to reproduce a release. There was no centralised audit trail to demonstrate secure development practices, and no formal approval or change governance step before a production release. Together this left the customer exposed to security vulnerabilities, compliance gaps, and avoidable deployment failures.

Our approach

The objective was to make security a condition of release rather than a review that happens afterwards, and to remove human intervention from the mechanics of deployment. The pipeline automates the build and deployment path to EC2, shifts security testing left through static and dependency analysis, validates the running application before promotion to production, and enforces approval gates and audit logging throughout.

Three security tools are integrated directly into the pipeline stages — SonarQube for static code analysis, Trivy for dependency and image scanning, and OWASP ZAP for dynamic runtime testing — with AWS CodePipeline, CodeBuild, and CodeDeploy handling orchestration, build, and release.

The solution in practice

Source control, static analysis, and dependency scanning

Developers commit to a centralised Git repository, and every commit automatically triggers AWS CodePipeline, which orchestrates all subsequent stages. During the build, CodeBuild runs SonarQube against the source to detect security vulnerabilities, code quality issues, hardcoded credentials, and unsafe coding patterns; critical findings fail the pipeline automatically and reports are retained as compliance evidence. Trivy then scans application dependencies, OS packages, and container images for known CVEs — the class of vulnerability source analysis alone cannot see — blocking vulnerable components before they reach production and reducing supply-chain risk.

Staging deployment and dynamic security testing

Artefacts are deployed to a staging EC2 environment through AWS CodeDeploy, with no direct SSH access required and health checks confirming stability before the pipeline advances. OWASP ZAP then performs dynamic testing against the live endpoint, simulating real-world attacks to detect SQL injection, cross-site scripting, authentication and session weaknesses, and security misconfigurations under genuine runtime conditions.

Approval, production release, and audit

A manual approval stage is enforced before production. Security and operations teams review the SonarQube, Trivy, and OWASP ZAP findings together, and only approved releases move forward — giving the customer a formal change governance checkpoint that was previously absent. Approved builds deploy to production EC2 via CodeDeploy using rolling or in-place strategies, with secrets managed through AWS Systems Manager Parameter Store and Secrets Manager rather than embedded in code. CloudWatch monitors pipeline and application health, CloudTrail records every deployment and configuration change, and AWS Config tracks the compliance state of EC2 and IAM configurations, with notifications sent on failures and pending approvals.

Infrastructure as code

The entire environment was defined as code. AWS CloudFormation templates provision the EC2 instances and Auto Scaling groups, Application Load Balancer, CodePipeline and CodeBuild resources, IAM roles and policies, and the networking layer including VPC, subnets, and security groups — making provisioning automated, repeatable, and version-controlled, and keeping development, staging, and production consistent over time.

Outcome

The customer now releases software through a pipeline where security is enforced, not requested. Vulnerabilities are caught at the earliest possible point, deployments are automated and reproducible, every change is recorded for audit, and no release reaches production without explicit sign-off backed by evidence.

Technologies used

• AWS CodePipeline
• AWS CodeBuild
• AWS CodeDeploy
• Amazon EC2
• Auto Scaling
• Application Load Balancer
• AWS CloudFormation
• SSM Parameter Store
• AWS Secrets Manager
• Amazon CloudWatch
• AWS CloudTrail
• AWS Config
• IAM
• SonarQube
• Trivy
• OWASP ZAP
• Git

← Back to all case studies