Progressive DevSecOps Pipeline Series

Level:Intermediate

Time:2-3 hours

Cost:medium

Works locally:No

Cloud creds:Yes

Cleanup:No

Reviewed:2026-05-30

Validation:mvn -q -f step-2-sast-sonarcloud/pom.xml test

Java Maven Jenkins Docker Kubernetes Sonarcloud Snyk Zap AWS Terraform

Overview

Six-step progressive DevSecOps pipeline from infra through DAST.

What You Will Build

Outcome Passing pipeline run plus scan/deploy evidence

Tools used Java, Maven, Jenkins, Docker, Kubernetes, Sonarcloud, Snyk, Zap, AWS, Terraform

Best fit Intermediate - 2-3 hours

Architecture Diagram

Student workstation Repository files CI/CD pipeline AWS account Validation proof

Prerequisites

• Install or review: Java, Maven, Jenkins, Docker, Kubernetes, Sonarcloud, Snyk, Zap.
• Use your own cloud account credentials and keep them out of commits.
• This project expects cloud resources, so verify budget alerts and cleanup first.
• Open the safety guide before running commands that create infrastructure.

Credentials And Cost Warning

Cost and credential stance

Cost risk is medium. Cloud target: AWS. Cloud credentials needed: Yes. Always use your own account, never commit secrets, and confirm cleanup before creating paid infrastructure.

Step-By-Step Lab

Use this flow before you run commands:

1. Read the cost and credential warning above.
2. Review the validation, troubleshooting, cleanup, and portfolio proof sections below.
3. Follow the original project guide preserved near the bottom of this page.
4. Return to the validation and cleanup checks before you capture portfolio evidence.

Validation Checks

Run the project validation command before and after meaningful changes:

mvn -q -f step-2-sast-sonarcloud/pom.xml test

Troubleshooting

• Run mvn -q -f step-2-sast-sonarcloud/pom.xml test first so local tooling issues are visible early.
• If a command fails, check tool versions, working directory, and required environment variables.
• For cloud failures, confirm account identity, region, quotas, and least-privilege IAM.
• For pipeline failures, check repository secrets, runner permissions, and pinned action versions.

Cleanup

No dedicated cleanup command was detected in the project README. Treat this as a warning: before provisioning anything, write down the exact delete, destroy, or rollback steps for your environment.

Portfolio Proof

• Validation command output: mvn -q -f step-2-sast-sonarcloud/pom.xml test
• Screenshot or terminal proof: Passing pipeline run plus scan/deploy evidence
• Notes explaining what changed, what failed, and how you fixed it
• Cleanup evidence, especially for cloud or Kubernetes resources

Original Project Guide

The original README content is preserved here for lab-specific commands and context. Headings are intentionally demoted so the page outline stays focused on the standard lab flow.

A 6-step progressive DevSecOps pipeline built with Jenkins, Terraform, Kubernetes, and security scanning tools.

Each step builds on the previous one, adding more security and deployment capabilities.

Steps

Step	Folder	Topic	Tools Added
1	step-1-infra-creation	AWS Infrastructure with Terraform	Terraform, Jenkins, EC2, K8s
2	step-2-sast-sonarcloud	Static Application Security Testing	SonarCloud
3	step-3-sca-snyk	Software Composition Analysis	Snyk
4	step-4-docker-ecr	Docker Build & Push to ECR	Docker, AWS ECR
5	step-5-deploy-k8s	Deploy to Kubernetes	K8s Deployment
6	step-6-dast-zap-e2e	Dynamic Testing & E2E	OWASP ZAP, E2E Tests

Architecture

Code Commit → Jenkins Pipeline
  → Step 1: Provision Infrastructure (Terraform)
  → Step 2: SAST Scan (SonarCloud)
  → Step 3: SCA Scan (Snyk)
  → Step 4: Docker Build & Push (ECR)
  → Step 5: Deploy to K8s
  → Step 6: DAST Scan (ZAP) + E2E Tests

Difficulty

🔴 Advanced

Key Technologies

Jenkins, Terraform, Kubernetes, Docker, SonarCloud, Snyk, OWASP ZAP, AWS ECR, AWS EKS

🛡️ 2026 DevSecOps Enhancements (What You Will Learn)

This series represents a mature 2026 DevSecOps integration, demonstrating a holistic “Shift-Left to Shift-Right” security posture:

1. Comprehensive Pipeline Gates: Instead of bolting on security at the end, this project embeds strict quality and security gates natively. Implementations like SAST (SonarCloud) and SCA (Snyk) preemptively block vulnerable code and transient dependencies from being built.
2. Dynamic Runtime Analysis: A critical addition is DAST (OWASP ZAP) against the live environment. By executing dynamic tests against the running Kubernetes application, we identify complex attack vectors and misconfigurations that static source code analysis inherently misses.

Source Files On GitHub

Use the guide first.

The full learning flow stays on this page. Open GitHub only when a step asks you to inspect code, fork the lab, or download source assets.

Read safety guide Open project source