2.3 Security Scanning, SAST/DAST & Approval Gates

Modern continuous delivery pipelines must integrate security verification directly into the automated release cycle—a practice known as DevSecOps or "shifting left." Identifying security vulnerabilities during the build and staging phases costs a fraction of remediation after a production compromise. On the AWS DOP-C02 exam, you will encounter complex scenarios requiring the orchestration of static code analysis, software composition scanning, container vulnerability management, dynamic application testing, and automated approval gating.

---

DevSecOps: Shifting Left in AWS CI/CD

Security verification is distributed across distinct pipeline phases to balance scan execution time against detection depth:

[Code Commit] ──> [Build & Package] ──> [Container Push] ──> [Staging Deploy] ──> [Prod Promotion]
      │                   │                    │                   │                     │
      ▼                   ▼                    ▼                   ▼                     ▼
 Secret Scanning     SAST & SCA           ECR Enhanced            DAST           Automated Approval
 (Gitleaks/Git)    (Bandit/Snyk/        (Amazon Inspector)    (OWASP ZAP /        Gate (Lambda +
                   cfn-guard)                                  Synthetics)         Security Hub)

---

SAST, SCA & Secret Scanning in CodeBuild

1. Static Application Security Testing (SAST)

SAST tools inspect application source code, abstract syntax trees (ASTs), and byte code without executing the program. SAST identifies common programming flaws, including SQL injection, cross-site scripting (XSS), insecure deserialization, and improper error handling.

• Execution in CodeBuild: SAST tools (such as Bandit for Python, Semgrep, SonarQube Scanner, or Checkmarx) run in the build or pre_build phase.
• Exit Code Enforcement: The buildspec executes the scanner and parses the output. If high-severity or critical vulnerabilities are identified, the command exits with a non-zero status, terminating the build before artifacts are generated.

2. Software Composition Analysis (SCA)

Modern applications consist predominantly of open-source third-party dependencies (npm packages, Python wheels, Java JARs). SCA tools (such as OWASP Dependency-Check, Snyk, or Trivy) parse dependency manifests (package-lock.json, pom.xml, Pipfile.lock) and cross-reference them against the National Vulnerability Database (NVD) for known Common Vulnerabilities and Exposures (CVEs).

• CodeArtifact Integration: AWS CodeArtifact can act as a secure package repository mirror with upstream connections to npmjs, PyPI, or Maven Central. Teams can automate vulnerability audits at the artifact registry level, restricting developers from pulling packages with known critical CVEs.

3. Secret Detection

Hardcoded credentials (AWS access keys, database passwords, private API tokens) represent a major vulnerability class. Tools like Gitleaks or TruffleHog execute during the pre_build phase of CodeBuild to scan commit histories and diffs for regex patterns matching AWS access keys (AKIA[0-9A-Z]{16}) and private certificates.

---

Container Image Security: Amazon ECR Basic vs Enhanced Scanning

When packaging microservices into container images, container repositories must be audited for base operating system vulnerabilities and embedded language runtime packages. AWS provides two distinct scanning tiers in Amazon Elastic Container Registry (ECR):

Comprehensive Comparison: ECR Scanning Tiers

Automated Pipeline Gating with ECR & Inspector

To gate an AWS CodePipeline workflow based on ECR container scan findings:

1. Push & Wait: CodeBuild builds the Docker image and pushes it to Amazon ECR.
2. Scan Execution: ECR Enhanced Scanning (Amazon Inspector) automatically analyzes the image.
3. Gating Check in CodeBuild: A post_build script queries the findings via the AWS CLI:

echo "Querying Amazon ECR image scan findings..."
SCAN_FINDINGS=$(aws ecr describe-image-scan-findings \
  --repository-name my-app-repo \
  --image-id imageTag=$IMAGE_TAG \
  --query 'imageScanFindings.findingSeverityCounts' \
  --output json)

CRITICAL_COUNT=$(echo $SCAN_FINDINGS | jq '.CRITICAL // 0')
HIGH_COUNT=$(echo $SCAN_FINDINGS | jq '.HIGH // 0')

echo "Scan Results: Critical=$CRITICAL_COUNT, High=$HIGH_COUNT"

if [ "$CRITICAL_COUNT" -gt 0 ] || [ "$HIGH_COUNT" -gt 5 ]; then
  echo "ERROR: Security gate failed! Critical/High vulnerabilities exceed threshold." >&2
  exit 1
fi

If critical vulnerabilities exceed the threshold, CodeBuild exits with code 1, stopping the pipeline before the image is deployed to ECS or EKS.

---

Dynamic Application Security Testing (DAST) & IaC Policy-as-Code

Dynamic Application Security Testing (DAST)

Unlike SAST, DAST analyzes an application from the outside in while it is running in a live staging environment. DAST tools (such as OWASP ZAP or commercial scanners running in CodeBuild containers) send malicious payloads to test for runtime vulnerabilities:

• Cross-Site Scripting (XSS) reflection
• SQL and Command Injection
• Broken Object Level Authorization (BOLA)
• Insecure Transport Layer Security (TLS) cipher suites and missing HTTP security headers (CSP, HSTS)

DAST should be executed against dedicated, isolated staging environments rather than shared or production stacks, as automated fuzzing can corrupt backend database records.

Infrastructure as Code (IaC) Policy-as-Code: cfn-guard vs cfn-nag

Security must also protect infrastructure configurations before CloudFormation templates are provisioned:

• cfn-guard (AWS CloudFormation Guard): An open-source, general-purpose policy-as-code evaluation tool developed by AWS. It uses a lightweight, human-readable Domain Specific Language (DSL) to enforce custom organizational compliance policies on CloudFormation templates, CDK output, and Terraform JSON.

  Example cfn-guard rule ensuring all S3 buckets have server-side encryption enabled:

  let s3_buckets = Resources.*[ Type == 'AWS::S3::Bucket' ]
  rule S3_BUCKET_ENCRYPTION_CHECK when %s3_buckets !empty {
    %s3_buckets.Properties.BucketEncryption.ServerSideEncryptionConfiguration[*] {
      ServerSideEncryptionByDefault.SSEAlgorithm in ['AES256', 'aws:kms']
    }
  }
  

• cfn-nag: A community Ruby tool that statically scans CloudFormation templates for known insecurity patterns (e.g., IAM policies with Resource: *, security groups with ingress from 0.0.0.0/0 on port 22 or 3389, or unencrypted EBS volumes).

Both tools execute in CodeBuild before any CloudFormation CreateChangeSet or ExecuteChangeSet action, failing the build if compliance checks are violated.

---

Approval Gates: Manual Notifications vs Automated Lambda Gating

1. Manual Approval Actions with Amazon SNS

In enterprise regulated environments, promoting code to production requires human authorization. AWS CodePipeline includes a native Manual Approval action:

• Configuration: You specify an Amazon SNS Topic ARN and optional custom approval URL (e.g., linking to test dashboards or security scan summaries).
• Notification: When the pipeline reaches the approval stage, CodePipeline publishes a message to the SNS topic. Subscribers (engineers, release managers, or Amazon Q Developer in chat applications in Slack or Microsoft Teams) receive the notification.
• Timeout: The manual approval action generates a unique execution approval token. Exam Watchout: The account-level default timeout is 7 days — if nobody approves or rejects within that window, the action is marked failed and the execution stops. The timeout is overridable per action through timeoutInMinutes, from a minimum of 5 minutes up to 86,400 minutes (60 days).

2. Automated Lambda-Based Approval Gating

To achieve true continuous deployment without manual human bottlenecks, organizations implement automated approval gates using AWS Lambda and Amazon EventBridge:

[CodePipeline Stage: Security Approval]
                   │
       (Enters Pending Approval)
                   │
                   ▼
   [Amazon EventBridge Rule]
   (Matches CodePipeline Action State Change: InProgress)
                   │
                   ▼
         [AWS Lambda Function]
                   │
       ┌───────────┴───────────┐
       ▼                       ▼
[Query Security Hub]    [Query Inspector / SonarQube]
       │                       │
       └───────────┬───────────┘
                   ▼
      {Are Critical CVEs == 0?}
       ├── Yes ──> [Call PutApprovalResult (Approved)] ──> [Pipeline Proceeds to Prod]
       └── No  ──> [Call PutApprovalResult (Rejected)] ──> [Pipeline Aborted & SNS Alert]

The Lambda function queries AWS Security Hub for findings associated with the current pipeline execution version. If all security criteria are met, the Lambda function calls codepipeline:PutApprovalResult with Status: Approved. If any critical vulnerability exists, it passes Status: Rejected along with the finding summary, preventing production promotion.

---

Comparison: Security Testing Modalities

---

Exam Watchouts & Operational Pitfalls

[!IMPORTANT] ECR Basic Scanning vs Enhanced Scanning Scope: Questions on the DOP-C02 exam frequently test whether ECR Basic Scanning can detect vulnerabilities in application dependencies (e.g., Python pip packages or Node.js npm modules). It cannot. ECR Basic Scanning only scans Linux operating system packages. To continuously detect vulnerabilities in both OS and application programming language packages, you must enable Amazon ECR Enhanced Scanning powered by Amazon Inspector.

[!WARNING] Approval Timeout: The account-level default timeout for a manual approval action is 7 days, so an execution left pending longer than that fails unless the action raises its own timeout. If your release cadence requires a change advisory board (CAB) that meets bi-weekly, either set timeoutInMinutes on that action (up to 86,400 minutes / 60 days), separate build artifact creation from deployment pipelines, or trigger release pipelines on demand.

[!NOTE] DAST Scan Impact on Staging Data: DAST tools actively submit forms, inject SQL escape characters, and fuzz API endpoints. Running unconstrained DAST scans against shared databases can lead to data corruption, account lockouts, or triggering rate-limiting WAF rules. Always configure DAST tools to target sanitized, ephemeral test databases with rate-limiting constraints.