In this blog post, we delve into using Amazon Web Services (AWS) data protection services such as Amazon Secrets Manager, AWS Key Management Service (AWS KMS), and AWS Certificate Manager (ACM) to help fortify both the security of the pipeline and security in the pipeline. We explore how these services contribute to the overall security of the DevOps pipeline infrastructure while enabling seamless integration of data protection measures. We also provide practical insights by demonstrating the implementation of these services within a DevOps pipeline for a three-tier WordPress web application deployed using Amazon Elastic Kubernetes Service (Amazon EKS).

   <p>DevOps pipelines involve the continuous integration, delivery, and deployment of cloud infrastructure and applications, which can store and process sensitive data. The increasing adoption of DevOps pipelines for cloud infrastructure and application deployments has made the protection of sensitive data a critical priority for organizations.</p> 
   <p>Some examples of the types of sensitive data that must be protected in DevOps pipelines are:</p> 
   <ul> 
    <li><strong>Credentials:</strong> Usernames and passwords used to access cloud resources, databases, and applications.</li> 
    <li><strong>Configuration files:</strong> Files that contain settings and configuration data for applications, databases, and other systems.</li> 
    <li><strong>Certificates:</strong> TLS certificates used to encrypt communication between systems.</li> 
    <li><strong>Secrets:</strong> Any other sensitive data used to access or authenticate with cloud resources, such as private keys, security tokens, or passwords for third-party services.</li> 
   </ul> 
   <p>Unintended access or data disclosure can have serious consequences such as loss of productivity, legal liabilities, financial losses, and reputational damage. It’s crucial to prioritize data protection to help mitigate these risks effectively.</p> 
   <p>The concept of <em>security of the pipeline</em> encompasses implementing security measures to protect the entire DevOps pipeline—the infrastructure, tools, and processes—from potential security issues. While the concept of <em>security in the pipeline</em> focuses on incorporating security practices and controls directly into the development and deployment processes within the pipeline.</p> 
   <p>By using <a href="https://aws.amazon.com/secrets-manager/" target="_blank" rel="noopener">Secrets Manager</a>, <a href="https://aws.amazon.com/kms/" target="_blank" rel="noopener">AWS KMS</a>, and <a href="https://aws.amazon.com/certificate-manager/" target="_blank" rel="noopener">ACM</a>, you can strengthen the security of your DevOps pipelines, safeguard sensitive data, and facilitate secure and compliant application deployments. Our goal is to equip you with the knowledge and tools to establish a secure DevOps environment, providing the integrity of your pipeline infrastructure and protecting your organization’s sensitive data throughout the software delivery process.</p> 
   <h2>Sample application architecture overview</h2> 
   <p>WordPress was chosen as the use case for this DevOps pipeline implementation due to its popularity, open source nature, containerization support, and integration with AWS services. The sample architecture for the WordPress application in the AWS cloud uses the following services:</p> 
   <ul> 
    <li><a href="https://aws.amazon.com/route53/" target="_blank" rel="noopener">Amazon Route 53</a>: A DNS web service that routes traffic to the correct AWS resource.</li> 
    <li><a href="https://aws.amazon.com/cloudfront/" target="_blank" rel="noopener">Amazon CloudFront</a>: A global content delivery network (CDN) service that securely delivers data and videos to users with low latency and high transfer speeds.</li> 
    <li><a href="https://aws.amazon.com/waf/" target="_blank" rel="noopener">AWS WAF</a>: A web application firewall that protects web applications from common web exploits.</li> 
    <li><a href="https://aws.amazon.com/certificate-manager/" target="_blank" rel="noopener">AWS Certificate Manager (ACM)</a>: A service that provides SSL/TLS certificates to enable secure connections.</li> 
    <li><a href="https://aws.amazon.com/elasticloadbalancing/application-load-balancer/" target="_blank" rel="noopener">Application Load Balancer (ALB)</a>: Routes traffic to the appropriate container in Amazon EKS.</li> 
    <li><a href="https://aws.amazon.com/eks/" target="_blank" rel="noopener">Amazon Elastic Kubernetes Service (Amazon EKS)</a>: A scalable and highly available Kubernetes cluster to deploy containerized applications.</li> 
    <li><a href="https://aws.amazon.com/rds/" target="_blank" rel="noopener">Amazon Relational Database Service (Amazon RDS)</a>: A managed relational database service that provides scalable and secure databases for applications.</li> 
    <li><a href="https://aws.amazon.com/kms/" target="_blank" rel="noopener">AWS Key Management Service (AWS KMS)</a>: A key management service that allows you to create and manage the encryption keys used to protect your data at rest.</li> 
    <li><a href="https://aws.amazon.com/secrets-manager/" target="_blank" rel="noopener">AWS Secrets Manager</a>: A service that provides the ability to rotate, manage, and retrieve database credentials.</li> 
    <li><a href="https://aws.amazon.com/codepipeline/" target="_blank" rel="noopener">AWS CodePipeline</a>: A fully managed continuous delivery service that helps to automate release pipelines for fast and reliable application and infrastructure updates.</li> 
    <li><a href="https://aws.amazon.com/codebuild/" target="_blank" rel="noopener">AWS CodeBuild</a>: A fully managed continuous integration service that compiles source code, runs tests, and produces ready-to-deploy software packages.</li> 
    <li><a href="https://aws.amazon.com/codecommit/" target="_blank" rel="noopener">AWS CodeCommit</a>: A secure, highly scalable, fully managed source-control service that hosts private Git repositories.</li> 
   </ul> 
   <p>Before we explore the specifics of the sample application architecture in Figure 1, it’s important to clarify a few aspects of the diagram. While it displays only a single Availability Zone (AZ), please note that the application and infrastructure can be developed to be highly available across multiple AZs to improve fault tolerance. This means that even if one AZ is unavailable, the application remains operational in other AZs, providing uninterrupted service to users.</p> 
   <div id="attachment_32489" class="wp-caption aligncenter"> 
    <img aria-describedby="caption-attachment-32489" src="https://infracom.com.sg/wp-content/uploads/2024/01/img1-15.png" alt="Figure 1: Sample application architecture" width="780" class="size-full wp-image-32489"> 
    <p id="caption-attachment-32489" class="wp-caption-text">Figure 1: Sample application architecture</p> 
   </div> 
   <p>The flow of the data protection services in the post and depicted in Figure 1 can be summarized as follows:</p> 
   <p>First, we discuss securing your pipeline. You can use Secrets Manager to securely store sensitive information such as Amazon RDS credentials. We show you how to retrieve these secrets from Secrets Manager in your DevOps pipeline to access the database. By using Secrets Manager, you can protect critical credentials and help prevent unauthorized access, strengthening the security of your pipeline.</p> 
   <p>Next, we cover data encryption. With AWS KMS, you can encrypt sensitive data at rest. We explain how to encrypt data stored in Amazon RDS using AWS KMS encryption, making sure that it remains secure and protected from unauthorized access. By implementing KMS encryption, you add an extra layer of protection to your data and bolster the overall security of your pipeline.</p> 
   <p>Lastly, we discuss securing connections (data in transit) in your WordPress application. ACM is used to manage SSL/TLS certificates. We show you how to provision and manage SSL/TLS certificates using ACM and configure your Amazon EKS cluster to use these certificates for secure communication between users and the WordPress application. By using ACM, you can establish secure communication channels, providing data privacy and enhancing the security of your pipeline.</p> 
   <blockquote> 
    <p><strong>Note:</strong> The code samples in this post are only to demonstrate the key concepts. The actual code can be found on <a href="https://github.com/aws-samples/aws-pipeline-dataprotection" rel="noopener" target="_blank">GitHub</a>.</p> 
   </blockquote> 
   <h2>Securing sensitive data with Secrets Manager</h2> 
   <p>In this sample application architecture, Secrets Manager is used to store and manage sensitive data. The <a href="https://aws.amazon.com/cloudformation/" target="_blank" rel="noopener">AWS CloudFormation</a> template provided sets up an <a href="https://aws.amazon.com/rds/mysql/" target="_blank" rel="noopener">Amazon RDS for MySQL</a> instance and securely sets the master user password by retrieving it from Secrets Manager using KMS encryption.</p> 
   <p>Here’s how Secrets Manager is implemented in this sample application architecture:</p> 
   <ol> 
    <li>Creating a Secrets Manager secret. 
     <ol> 
      <li>Create a Secrets Manager secret that includes the Amazon RDS database credentials using CloudFormation.</li> 
      <li>The secret is encrypted using an AWS KMS customer managed key.</li> 
      <li>Sample code: 
       <div class="hide-language"> 
        <pre class="unlimited-height-code"><code class="lang-text"><span>RDSMySQL</span>:
<span>Type</span>: <span>AWS::RDS::DBInstance</span>
<span>Properties</span>: 
    <span>ManageMasterUserPassword</span>: <span>true</span>
    <span>MasterUserSecret</span>:
            <span>KmsKeyId: !Ref RDSMySqlSecretEncryption</span></code></pre> 
       </div> </li> 
     </ol> <p>The <span>ManageMasterUserPassword: true</span> line in the CloudFormation template indicates that the stack will manage the master user password for the Amazon RDS instance. To securely retrieve the password for the master user, the CloudFormation template uses the <span>MasterUserSecret</span> parameter, which retrieves the password from Secrets Manager. The <span>KmsKeyId: !Ref RDSMySqlSecretEncryption</span> line specifies the KMS key ID that will be used to encrypt the secret in Secrets Manager.</p> <p>By setting the <span>MasterUserSecret</span> parameter to retrieve the password from Secrets Manager, the CloudFormation stack can securely retrieve and set the master user password for the Amazon RDS MySQL instance without exposing it in plain text. Additionally, specifying the KMS key ID for encryption adds another layer of security to the secret stored in Secrets Manager.</p> </li> 
    <li>Retrieving secrets from Secrets Manager. 
     <ol> 
      <li>The secrets store CSI driver is a Kubernetes-native driver that provides a common interface for Secrets Store integration with Amazon EKS. The <span>secrets-store-csi-driver-provider-aws</span> is a specific provider that provides integration with the Secrets Manager.</li> 
      <li>To set up Amazon EKS, the first step is to create a <span>SecretProviderClass</span>, which specifies the secret ID of the Amazon RDS database. This <span>SecretProviderClass</span> is then used in the Kubernetes deployment object to deploy the WordPress application and dynamically retrieve the secrets from the secret manager during deployment. This process is entirely dynamic and verifies that no secrets are recorded anywhere. The <span>SecretProviderClass</span> is created on a specific app namespace, such as the wp namespace.</li> 
      <li>Sample code: 
       <div class="hide-language"> 
        <pre class="unlimited-height-code"><code class="lang-text">apiVersion: secrets-store.csi.x-k8s.io/v1

kind: SecretProviderClass
spec:
provider: aws
parameters:
objects: |
– objectName: ‘rds!db-0x0000-0x0000-0x0000-0x0000-0x0000’

   When using Secrets manager, be aware of the following best practices for managing and securing Secrets Manager secrets:</p> 
   <ul> 
    <li>Use <a href="https://aws.amazon.com/iam/" target="_blank" rel="noopener">AWS Identity and Access Management (IAM)</a> identity policies to define who can perform specific actions on Secrets Manager secrets, such as reading, writing, or deleting them.</li> 
    <li>Secrets Manager resource policies can be used to <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html" target="_blank" rel="noopener">manage access to secrets</a> at a more granular level. This includes defining who has access to specific secrets based on attributes such as IP address, time of day, or authentication status.</li> 
    <li>Encrypt the Secrets Manager secret using an AWS KMS key.</li> 
    <li>Using CloudFormation templates to automate the creation and management of Secrets Manager secrets including rotation.</li> 
    <li>Use <a href="https://aws.amazon.com/cloudtrail" target="_blank" rel="noopener">AWS CloudTrail</a> to monitor access and changes to Secrets Manager secrets.</li> 
    <li>Use CloudFormation hooks to validate the Secrets Manager secret before and after deployment. If the secret fails validation, the deployment is rolled back.</li> 
   </ul> 
   <h2>Encrypting data with AWS KMS</h2> 
   <p>Data encryption involves converting sensitive information into a coded form that can only be accessed with the appropriate decryption key. By implementing encryption measures throughout your pipeline, you make sure that even if unauthorized individuals gain access to the data, they won’t be able to understand its contents.</p> 
   <p>Here’s how data at rest encryption using AWS KMS is implemented in this sample application architecture:</p> 
   <ol> 
    <li><strong>Amazon RDS secret encryption</strong> 
     <ol> 
      <li>Encrypting secrets: An AWS KMS customer managed key is used to encrypt the secrets stored in Secrets Manager to ensure their confidentiality during the DevOps build process.</li> 
      <li>Sample code: 
       <div class="hide-language"> 
        <pre class="unlimited-height-code"><code class="lang-text">RDSMySQL:
Type: <span>AWS::RDS::DBInstance</span>
Properties:
  ManageMasterUserPassword: <span>true</span>
  MasterUserSecret:
    KmsKeyId: <span>!Ref RDSMySqlSecretEncryption</span>

RDSMySqlSecretEncryption:
Type: “AWS::KMS::Key”
Properties:
KeyPolicy:
Id: rds-mysql-secret-encryption
Statement:
– Sid: Allow administration of the key
Effect: Allow
“Action”: [
“kms:Create“,
“kms:Describe“,
“kms:Enable“,
“kms:List“,
“kms:Put*”,
.
.
.
]
– Sid: Allow use of the key
Effect: Allow
“Action”: [
“kms:Decrypt”,
“kms:GenerateDataKey”,
“kms:DescribeKey”
]