BSides SP 2024: Dumont Hackerspace

Provisioning in the past
DevSecOps Adoption
IaC (Infrastructure as Code)
Terraform Foundation
Terraform (Main commands)
Prisma Cloud (Checkov)
Demo Demonstration
Next Steps (What’s needs to be improved?)

Transcript

1. 1 DevSecOps with Checkov AWS, GitLab CI & Terraform
2. Hi! I am Amaury B. Souza I am here because I love to learn, share and help others. You can find me at @amaurybsouza 2
3. TABLE OF CONTENTS ╸ Provisioning in the past ╸ DevSecOps Adoption ╸ IaC (Infrastructure as Code) ╸ Terraform Foundation ╸ Terraform (Main commands) ╸ Prisma Cloud (Checkov) ╸ Demo Demonstration ╸ Next Steps (What’s needs to be improved?) 3
4. 1 How were things… Let’s start explain how were in the past
5. 5 IN THE PAST Let me introduce about automation, deploys, and the communication.
6. 6 DevSecOps How about the DevSecOps? Let me cover somethings.
7. PROVISIONING IN THE PAST ╸ Manual process (Bash Script) ╸ Many human errors ╸ Infrastucture is not versioned ╸ Communication loss (Dev + Ops) ╸ Not exist IaC (Infrastructure as Code) ╸ Cloud Platforms were be creating ╸ Extra knowledge required… ╸ Documentation were poor for tools 7
8. 8 2 DEVOPS CI/CD, IAC, GITOPS, CLOUD, AUTOMATION
9. EVERYTHING IS CODE, THERE IS DEVOPS, IAC, GITOPS, CI/CD DevOps culture is being strong. Companies and professionals are realizing the benefits of breaking down silos between development and operations teams to promote collaboration, efficiency and continuous delivery. 9
10. WHAT IS THE CHALLENGE? 10
11. 11 2 DEVSECOPS CI/CD, IAC, SECURITY, CLOUD, AUTOMATION
12. DEVSECOPS As deployments to production speed up, however, many traditional cloud security concepts break down. With the rise of containerized technologies, serverless functions, and IaC frameworks, it is increasingly harder to maintain visibility of cloud security posture. 12
13. DEVSECOPS ROADMAP 13 1 3 5 6 4 2 Get start using LINUX (CentOS, Debian, Ubuntu) Reproduce the same automation using Ansible/Python Deep dive into AWS platform (security certifications), Azure security Learning ways to automate the system using Bash scripts focused on security. Keep the focused to understand the CI/CD pipeline focused on security model (security). Learning about Prisma Cloud architecture, cortex.
14. 14 4 IAC IAC (INFRASTRUCTURE AS CODE)
15. 4.1 WHAT IS IAC? Keep aware about the Infrastructure as Code (IaC) & Mutable/Immutable infrastructures
16. INFRASTRUCTURE AS CODE Basically, IaC (Infrastructure as Code), is the way to manage and provisioning infrastructure through code instead of manual process. 16
17. Mutable Refers to the approach in which the infrastructure of a system or application can be dynanamically modified through automation (Ansible, Puppet, Chef). MUTABLE & IMMUTABLE INFRASTRUCTURES Immutable Refers to the approach where the configurations of systems and servers is defined only once during creation and is never changed afterwards. 17
18. 18 5 TERRAFORM IAC (INFRASTRUCTURE AS CODE)
19. TERRAFORM Terraform is an infrastructure as code software tool that’s provides a consistent CLI workflows to manage hundreds of cloud services. Terraform codifies cloud API’s into declarative configuration files. 19
20. TERRAFORM: OTHER FEATURES Providers: interact with cloud providers, SaaS providers and other APIS’s. Resources: a block describes one or more infrastructure objects. Modules: a collection of “.tf” file kept together in a directory. 20
21. THE TERRAFORM PROCESS IS EASY 21 $ terraform apply Builds or changes infrastructures. You can pass the –auto-approve option to instruct Terraform to apply the plan without asking for confirmation. Usage: terraform apply [options] $ terraform init Initialize a Terraform working directory containing Terraform configurations files. This is the first command that should be run after writing a new Terraform code. Usage: terraform init [options] $ terraform plan Generate and show an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure. Usage: terraform plan [options]
22. TERRAFORM BENEFITS Versioning You can versioning your HomeLab infrastructure files using GitHub (GIT Flow). Each change can be associated with a specific version of the HomeLab. Tracing You can track and document changes to a system over time. From (IaC) perspective is an important feature what provides visibility into modifications like, rollback, auding, stating view. Declarative You can declare your disired state of the infrastructure and Terraform determines how to make those changes, without worrying about the specific steps to achieve it. 22
23. SECURITY CHALLENGES WITH TERRAFORM ╸ Configurations errors ╸ Resources publicly exposed by mistake. ╸ Security vulnerabilities ╸ Use of compromised or insecurely configured credentials. ╸ Compliance ╸ Not following the guideline of GDPR. 23
24. 24 6 CHECKOV Code Scanning with Checkov
25. CHECKOV BY PRISMA CLOUD Checkov is an open source 'policy-as-code' tool that scans cloud infrastructure definitions to find misconfigurations before they are deployed. Some of the key benefits of checkov: 1- Runs as a command line interface (CLI) tool 2- Supports many common platforms and frameworks 3- Ships with thousands of default policies 4- Works on Windows/MAC/Linux (any system with python installed) 25
26. SCAN WITH CHECKOV Checkov can be configured to scan files and enforce policies in many different ways. To highlight a few: 1. Scans can run on individual files or entire directories. 2. Policies can be selected through selection or omission. 3. Enforcement can be determined by flags that control checkov's exit code. 26
27. 2 Ansible Automation CM (Configuration Management)
28. 2 Ansible Automation CM (Configuration Management) Failed checks are returned containing the offending file and resource, the lines of code that triggered the policy, and a guide to fix the issue.
29. 2 Ansible Automation CM (Configuration Management) Enabling checkov in an IDE provides real-time scan results and inline fix suggestions to developers as they create cloud infrastructure and applications.
30. 2 Ansible Automation CM (Configuration Management)
31. 31 4 GITLAB CI IAC (INFRASTRUCTURE AS CODE)
32. 2 Ansible Automation CM (Configuration Management)
33. 2 Ansible Automation CM (Configuration Management)
34. 2 Ansible Automation CM (Configuration Management)
35. 35 7 DEMONSTRATION “Talk is cheap. Show me the code”. Linux Tovalds.
36. DEMO DEMONSTRATION This demonstration will cover how to leverage infrastructure as code (IaC) and DevSecOps patterns to automate, scale, and improve the security posture of cloud infrastructure and applications. 36
37. 2 Ansible Automation CM (Configuration Management)
38. 2 Ansible Automation CM (Configuration Management)
39. 2 Ansible Automation CM (Configuration Management)
40. 2 Ansible Automation CM (Configuration Management)
41. 2 Ansible Automation CM (Configuration Management)
42. 2 Ansible Automation CM (Configuration Management)
43. IAC LESSONS LEARNED 43 NETWORKING LINUX Prisma Cloud TERRAFORM GITOPS SECURITY PILLARS Take your HomeLab to a Cloud Platform (AWS). GIT flows is essential to automate 100% your DevSecOps). Versioning and test your pipe with (IaC) tool. Get out from papers, books more insights. Essential to create a security maturity Install a distro Linux from zero to obtain more experience.
44. THX! Any questions? You can find me at @amaurybsouza /amaurybsouza@gmail.com 44
45. CREDITS Special thanks to all the people who made this presentation possible and all the tech community. ╸ LHC (Campinas Hackerspace) ╸ Village Dumont Hackerspace ╸ BSides São Paulo Organization ╸ My family to support me on this work 45
46. 160,000$ DevOps Specialist salary (USA) 79% of developers want to use ChatGPT again next year. 53,08% people learning to code are still using AWS 46
47. Passar 15 minutos fazendo uma tarefa? PASSAR 6 HORAS AUTOMATIZANDO UMA TAREFA QUE PODIA SER FEITA EM 15 MINUTOS. @coproduto. 47