This project is a complete DevSecOps pipeline that automates the deployment of a WordPress application on AWS using:
- Terraform for Infrastructure as Code
- Docker for containerization
- AWS CodePipeline for CI/CD
- AWS ECR for container registry
- AWS ECS for container orchestration
- Trivy for security scanning
- GitHub for source control
- AWS Account
- GitHub Account
- Docker installed
- Terraform installed
- AWS CLI configured
GitHub → CodePipeline → CodeBuild → ECR → ECS ↓ Security Scanning (Trivy, SAST, SCA)
text
git clone https://github.com/yourusername/devsecops-factory.git
cd devsecops-factory
2. Deploy infrastructure
bash
cd terraform
terraform init
terraform apply
3. Deploy the pipeline
bash
cd ../pipeline
aws cloudformation deploy \
--template-file pipeline.yml \
--stack-name devsecops-pipeline \
--capabilities CAPABILITY_NAMED_IAM \
--parameter-overrides \
GitHubOwner=yourusername \
GitHubRepo=devsecops-factory \
GitHubBranch=main \
GitHubToken=yourgithubtoken
4. Run the deployment script
bash
cd ../scripts
./deploy.sh
Testing
Test locally:
bash
cd app/wordpress-app
docker compose up -d
Run security scans:
bash
cd ../scripts
./security-scan.sh
CI/CD Pipeline Stages
Source: GitHub
Build: Docker image creation
Security Scan: Trivy vulnerability scanning
Push: ECR repository
Deploy: ECS service
Security Features
Shift-left security: Scanning code at every stage
Vulnerability scanning: Trivy for container and filesystem
Secrets detection: Preventing sensitive data exposure
Infrastructure as Code: Immutable infrastructure
Monitoring
CloudWatch: Logs and metrics
Security Hub: Centralized security findings
Clean Up
bash
# Delete the pipeline stack
aws cloudformation delete-stack --stack-name devsecops-pipeline
# Destroy infrastructure
cd terraform
terraform destroy
License
MIT
text
---
## **Step 3: Commit and Push Everything**
```bash
cd ~/devsecops-factory
git add .
git commit -m "Add CI/CD pipeline and deployment scripts"
git push origin main