DevSecOps Capstone Project

Project Overview

This repository contains the source code and Infrastructure as Code (IaC) for a comprehensive DevSecOps pipeline deployed on AWS. The project demonstrates a secure software supply chain for a .NET Core Web API, incorporating automated security scanning, containerization, and orchestration via Amazon EKS.

Architecture

The infrastructure is provisioned using Terraform and consists of:

• VPC: Custom Virtual Private Cloud with public/private subnets across multiple AZs.
• CI/CD Server: Jenkins Controller on EC2 (Ubuntu) with Docker-in-Docker capabilities.
• Orchestration: Amazon Elastic Kubernetes Service (EKS) for application hosting.
• Security: IAM Roles for Service Accounts (IRSA) and minimal-privilege Security Groups.

CI/CD Pipeline

The pipeline is defined in Jenkinsfile and enforces a "Shift Left" security approach:

1. Checkout: Source Code Management (SCM) retrieval.
2. Secret Detection: Gitleaks scan to prevent credential commits.
3. Build & Unit Test: .NET Core compilation and testing.
4. Static Analysis (SAST): SonarQube integration for code quality (Community Edition).
5. Filesystem Scan: Trivy scan for OS dependency vulnerabilities.
6. Containerization: Docker build and tag.
7. Image Scan: Trivy image scanning for CVEs in the final artifact.
8. Registry Push: Upload to Docker Hub.
9. Deployment: Automated Push Deployment via Jenkins/kubectl.

Prerequisites

• AWS CLI v2.x
• Terraform v1.5+
• Docker v20.x
• Kubectl v1.27+
• dotnet SDK 8.0

Quick Start

1. Provision Infrastructure

Navigate to the terraform directory and apply the configuration:

cd terraform
terraform init
terraform plan
terraform apply --auto-approve

2. Configure Jenkins

1. Access Jenkins via the output Public IP: http://<JENKINS_IP>:8080
2. Install recommended plugins (Docker Pipeline, Kubernetes CLI, SonarQube Scanner).
3. Configure Credentials:
   • docker-hub: Username/Password for Docker Registry.
   • github-token: PAT for Git checkout.
   • sonar-token: Token for SonarQube analysis.

3. Deploy Tooling (Optional)

Deploy the observability and security stack to EKS:

./scripts/deploy_tools.sh

Includes: SonarQube, Nexus, Prometheus, Grafana.

Security Measures

• Infrastructure: All nodes are deployed in private subnets; access is restricted via Security Groups.
• Runtime: Applications run as non-root users (where applicable).
• Compliance: Automated vulnerability gating in CI prevents insecure artifacts from being deployed.

Repository Structure

├── app/                 # .NET Core Application Source
├── k8s/                 # Kubernetes Manifests (Deployment, Service)
├── scripts/             # Helper scripts (Tool deployment)
├── terraform/           # Infrastructure as Code
│   ├── modules/         # Reusable Terraform Modules (VPC, EKS, Jenkins)
│   └── main.tf          # Root Configuration
├── Jenkinsfile          # Declarative CI/CD Pipeline
└── README.md            # Project Documentation

Contribution

Contributions are welcome. Please open an issue or submit a Pull Request following the standard fork-and-branch workflow.

License

MIT License.