Security as Code

Preface

The authors of this book work with enterprise AWS customers who have business-critical applications running in the cloud, so we think about security on a daily basis. In recent years, we’ve noticed that the term DevSecOps pops up in nearly every security strategy discussion. Everyone wants it, but not as many people understand it—and it seems like almost nobody knows where to start or what to do.

DevSecOps is a relatively new field, and few books are available to guide those who want to learn more about it. We decided to write this book to help fill that gap by showing you how and where to get started on DevSecOps in AWS.

This book is not an enterprise-grade solution kit for copying and pasting into production (and since every project and organization has different needs, we sincerely hope you would never do that!). Instead, it’s designed to introduce you to the building blocks of the DevSecOps mindset, and to guide you along the way with practical examples. We use popular open source tools where possible, to show you that it’s not always necessary to buy expensive products to do security the right way.

We use a fictitious company called Automatoonz to illustrate some of the real-world issues you’re likely to face in your DevSecOps journey. As we discuss a problem, the Automatoonz team works on it too, giving you a sense of how real teams approach solving the problem at hand. Although the scenarios are fictionalized, these examples come from our extensive personal experience, ...