CI-CD

📌 Pinned

DevSecOps Guardrails - Series Overview

CDK makes it easy to ship infrastructure fast. What I found running it in production is that a passing cdk synth is not the same as a safe deploy - there are four categories of risk a standard CI/CD pipeline leaves unchecked: IaC policy violations, CloudFormation template errors, application code quality issues, and vulnerable dependencies. Each one has a tool that catches it at build time. cdk-nag is the only CDK-specific tool - the others work with any CI/CD pipeline. ...

Posts

DevSecOps Guardrails - Policy Checks with cdk-nag

This is Chapter 1 of the DevSecOps Guardrails series. I wired cdk-nag in as the first guardrail in this series because it is CDK-native: it runs against the construct tree at synth time and blocks the build on any rule violation - before a changeset is created, before any AWS API call is made. It sees the construct level, not just the synthesised template, which means it can catch things cfn-lint cannot. ...

AWS CDK - CI/CD Pipelines

This is Chapter 5 of the Infrastructure as Code with AWS CDK series. The same cdk deploy command that runs locally works in any pipeline - the differences are auth and orchestration. Common flags for CI These apply regardless of which CI system you use: cdk synth # generate CloudFormation template cdk deploy --require-approval never -c env=prod # deploy without interactive prompts cdk deploy --outputs-file outputs.json # write stack outputs to file --require-approval never skips the IAM change confirmation that CDK shows interactively. Required in CI. ...