CI/CD Security Best Practices

# CHAPTER 13

CI/CD Security Best Practices #

1. Introduction #

2. Learning Objectives #

• Understand the concept and devastating impact of a "Supply Chain Attack."

• Implement Dependency Scanning (SCA) into a CI pipeline.

• Implement Secret Scanning to prevent credential leakage.

• Enforce the Principle of Least Privilege for CI Runners.

• Understand the security implications of third-party pipeline plugins/Actions.

3. Beginner-Friendly Explanation #

• A Normal Attack: A criminal breaks into one house and poisons the tap water. One family gets sick. (Hacking a single server).

• A Supply Chain Attack: A criminal breaks into the water treatment plant and dumps poison into the main reservoir. The plant automatically pumps the poisoned water to *every single house in the city*.

If your CI pipeline is compromised, it automatically builds, signs, and deploys the hacker's malware to your entire customer base, thinking it is legitimate software. Securing the pipeline is protecting the reservoir.

4. Supply Chain Security (Dependency Scanning) #

Software Composition Analysis (SCA): We must add a step to our pipeline that scans our package.json or composer.lock file against a global database of known vulnerabilities (CVEs) *before* the code is built.

5. Mini Project: Secure CI Pipeline (Trivy) #

Step-by-Step Architecture Concept:

name: DevSecOps Quality Gate

on: [pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      # 1. SECRET SCANNING
      - name: Run TruffleHog Secret Scanner
        uses: trufflesecurity/trufflehog@main
        with:
          # Scans the entire commit history for leaked API keys or passwords
          extra_args: --only-verified

      # 2. DEPENDENCY VULNERABILITY SCANNING (SCA)
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'table'
          # If Trivy finds a 'CRITICAL' vulnerability in a 3rd party package,
          # it returns Exit Code 1, INSTANTLY FAILING THE PIPELINE!
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

*By placing this Job at the very beginning of the pipeline, we guarantee that no code is compiled or deployed if it relies on critically vulnerable open-source packages.*

6. The Principle of Least Privilege (Runners) #

The Fix:

1. 1. Never inject Production secrets into Pull Request pipelines. Pull Requests should only have access to Staging environments.

1. 2. Strict IAM Policies: The AWS User assigned to the CI runner must only have the specific permissions it needs. If it deploys to S3 Bucket A, its IAM policy must explicitly DENY access to S3 Bucket B and DynamoDB.

7. Real-World Scenarios #

8. Best Practices #

• Pinning Action Hashes: In previous chapters, we pinned GitHub Actions to a version tag (e.g., uses: actions/checkout@v4). This is good, but a hacker could theoretically compromise the author's repository and overwrite the v4 tag with malicious code. The absolute highest security standard is to pin the cryptographic SHA hash of the Action:

9. Security Recommendations #

• Require Approvals for External PRs: If your repository is public, anyone on the internet can open a Pull Request. If your CI pipeline is set to run automatically on [pull_request], the hacker's malicious code will execute on your runner, potentially stealing your environmental secrets. You must configure your CI platform to "Require approval for workflows from outside collaborators."

10. Troubleshooting Tips #

• False Positives in Scanners: SCA scanners (like Trivy) will sometimes flag a High vulnerability in a package that your application uses in a completely secure way, blocking your deployment. You must manage a .trivyignore file to manually suppress specific CVE IDs after a security engineer has investigated and confirmed they are false positives, allowing the pipeline to pass.

11. Exercises #

1. 1. Define a "Supply Chain Attack" in the context of a CI/CD pipeline. Why are these attacks so devastating?

1. 2. Explain the security benefit of pinning a third-party pipeline Action to a cryptographic SHA hash instead of a semantic version tag (like v2).

12. FAQs #

13. Interview Questions #

• Q: Describe the operational purpose of Software Composition Analysis (SCA) within a DevSecOps pipeline. How does integrating an SCA tool like Trivy mitigate the risks of open-source dependency poisoning?

• Q: A developer submits a Pull Request that executes env in a pipeline step to maliciously print all injected CI environment variables to the public logs. Outline the defense-in-depth strategies required to prevent this from compromising production infrastructure.

14. Summary #

15. Next Chapter Recommendation #