20241009 JAX 2024 Putting Sec in DevSecOps for an AWS Lambda Based System

In this talk, I’ll dive into the development journey of Seatbelt, a transformative software plugin for Atlassian Jira that empowers teams by enhancing their reporting accuracy and reliability. Seatbelt helps identify incomplete or incorrect data within Jira workflows, making it easier for users to pinpoint and fix errors swiftly. This boosts team productivity and ensures more consistent, high-quality data across projects.

We’ll explore how we leveraged Amazon AWS serverless technologies to build the core of Seatbelt. Specifically, we utilized AWS Lambda functions, which allow for highly secure, scalable, and efficient execution. By retrieving credentials at runtime and only running for short durations, these Lambda functions minimize security risks and make credential management seamless. I’ll share insights into how this design ensures a lightweight and cost-effective solution for teams, while improving both security and scalability.

In addition, the talk will cover our Kubernetes version of Seatbelt, built for organizations that cannot use the public internet, such as government agencies. Here, we’ve integrated Presto, an open-source SQL query engine, to enhance data access and processing. Additionally, we utilized Knative functions to support lambda functions implemented in GoLang, and the Envoy proxy to enforce access controls, providing east-west security across every component of the system.

Attendees will leave with an understanding of how modern cloud technologies can be used to solve real-world challenges in data management and reporting within Jira. Whether you’re a software developer, project manager, or system architect, this session will provide key takeaways for building secure, scalable, and efficient software for the enterprise.

1. TRACK: DEVSECOPS
October 09, 2024
Craeg Strong, Ariel Partners
Putting the Sec in DevSecOps
for an AWS Lambda Based
System

2. TRACK: DEVSECOPSCraeg Strong
▪Software Development since 1988
▪Large Commercial & Government Projects
▪Kanban Coach / DevOps Engineer
▪Kanban Trainer / SpecFlow Trainer
▪Performance & Scalability Architect
▪Certified Ethical Hacker
▪New York & Washington DC Area
CTO, Ariel Partners
FLC, AKC, AKT, KCP, KMP, CSM, CSP,
CSPO, ITILv3, PMI-ACP, PMP, CLP, SPC,
ICP-ACC, ICP-ATF, PSM-II, PSK
www.arielpartners.com
[email protected]
@ckstrong1

3. TRACK: DEVSECOPSAgenda
•About Me
•Background and Context
•Serverless Version
•Cyber Security Practices
•Architecture
•Getting to Zero Trust
•CI/CD Pipeline
•Vulnerability Scanning
•Kubernetes Version
•Architecture
•Zero Trust
•Summary and Takeaways

4. TRACK: DEVSECOPS
•Modern Project/Task
Management Tools are
Complex & Flexible
•Agile Teams Don’t Have a
Dedicated PM Resource
•Team Members Are not Tool
Experts
•Agile teams place more value
in delivering beautiful software
rather than beautiful reports
•Many teams receive
inadequate training for tools
•Agile Management Tools
are full of missing,
incomplete, or incorrect
data
•Reports are somewhat
misleading, totally wrong,
or won’t run at all
•Senior management
cannot not get aggregated
reports they need to make
decisions
Cause Effect
Context

5. TRACK: DEVSECOPS
Manual Verification Checks: Agency 1

6. TRACK: DEVSECOPS
Manual Verification Checks: Agency 2

7. TRACK: DEVSECOPS
•Jira Plugin
•Helps Teams Keep Jira
Clean by reducing “Tool
Debt”
•Uses Gamification
•Helps Enforce Jira Usage
Policies
Seatbelt for Jira

8. TRACK: DEVSECOPS
Seatbelt for Jira

9. TRACK: DEVSECOPS
Zero Trust for
Serverless

10. TRACK: DEVSECOPS
Zero
Trust
1.Ensure the organization is observing
good cyber hygiene
2.Secure all the software components
3.Track and manage all third-party
dependencies
4.Secure the build/release process
5.Secure the deployment infrastructure
6.Secure data at rest and in motion
7.Don't trust any network, including your
own. Enforce authentication and
authorization everywhere. Assume the
network is hostile.
Securing Our Architecture

11. TRACK: DEVSECOPS
AWS
AWS API
Gateway
Lambda
Seatbelt
API
AWS Step
Functions
Seatbelt
Actions
GlueAthena
S3
DynamoDB
Project
Data and
Metadata
Project
Data
Project
Metadata
S3Results
Jobs
AWS API
Gateway
JIRA
Webhook
Event
Query
ReST
API Call
Cognito

12. TRACK: DEVSECOPS
•All services are locked down. Nothing can
connect to anything by default
•At runtime, Lambda are given temporary
limited credentials just to connect to the
services they need
•Lambdas typically run for less than one
minute and then the credentials are destroyed
What makes this zero trust?
Seatbelt
API
Identity &
Access Manager
S3
IAM
Credentials
Authenticated
Access

13. TRACK: DEVSECOPS
Frontend:
NextJS TS
Backend:
Go Lang
compile
Static
analysis
CVE
analysis
Unit
test
SAM
deploy
E2e
test
compile
Static
analysis
CVE
analysis
Unit
test
SAM
deploy
E2e
test
Cyber
Tests
Vulnerability
Scan

14. TRACK: DEVSECOPS
Remediation Actions for ZAP Seatbelt
1.Return HTTP 400 for bad requests
2.Tune zap.tsv for false positives
3.Always return Content-Type header
4.Set Strict-Transport-Security
5.CORS fixes

15. TRACK: DEVSECOPS

16. TRACK: DEVSECOPS
CyberSecurityfor
Kubernetes

17. TRACK: DEVSECOPS
IL4/IL6 or On Prem
Kubernetes
Control Plane
Container
Web App
Firewall
Container
Container
Go Lambda
Function
Container
MongoDBPrestoDB
Container
Authentication
Envoy Control

18. TRACK: DEVSECOPS
•All services are locked down. Nothing can
connect to anything by default
•East-west traffic does not pass through the
aggregation point, so it’s protected via mesh
What makes this zero-trust?

19. TRACK: DEVSECOPSSummary
•Good Cyber Hygiene Involves many factors
•Zero trust means we don't trust any network,
including our own. We enforce authentication
and authorization everywhere. We assume the
network is hostile
•Serverless technology significantly reduces
attack surface
•Long-running services could increase attack
surface
•Service Mesh provides a control plane that can
be configured to enforce zero trust

20. TRACK: DEVSECOPS
[email protected] https://linkedin.com/in/cstrong
@arielpartners https://youtube.com/@Ariel.Partnershttps://arielpartners.com
THANKYOU