Security and Compliance in DevOps
Scope of this domain
Security and Compliance in DevOps tests how controls move into the delivery pipeline: automated scanning, secret management, least privilege, supply-chain integrity, policy as code and continuous evidence for auditors.
Core rules and concepts
- Shift left: threat modelling at design, SAST on commit, software composition analysis on dependencies, DAST against a running environment, image scanning before push.
- Secrets belong in a vault or cloud secret manager. Prefer short-lived credentials through OIDC workload identity over static keys; rotate immediately on exposure, because deleting a commit does not remove history or caches.
- Least privilege: narrowly scoped roles per pipeline stage, no long-lived administrator keys, separation of duties between who can deploy and who can approve.
- Supply chain: pin dependencies and lockfiles, generate an SBOM (SPDX or CycloneDX), sign artefacts with Sigstore/cosign, verify signatures at deploy time, and track SLSA provenance.
- Policy as code (OPA/Gatekeeper, Sentinel, cloud organisation policies) blocks non-compliant resources pre-merge and at admission.
- Compliance as code: automated evidence collection, immutable audit logs, CIS benchmark scans, drift reports and a documented exception path.
Worked example
A pipeline stores static AWS access keys in CI variables. Reasoning: long-lived keys never expire and a leak gives broad, persistent access. Move to OIDC federation: the CI provider issues a signed token, the pipeline assumes a role whose trust policy is scoped to the repository and branch, and credentials last 15 to 60 minutes. Add secret scanning with push protection and rotate anything already exposed, then check image and dependency scans in the same gate.
Traps that cost marks
- Assuming that deleting a secret from HEAD removes it; history and forks retain it.
- Gating on every SAST finding so teams disable the scan.
- Signing artefacts without verifying signatures at deploy.
- Treating compliance as an annual document instead of continuous evidence.
- Secrets leaking into build logs, error traces or artefact metadata.