ECS Deployment via GitLab CI
A Spring Boot app on ECS where Trivy and SonarQube gate the GitLab CI pipeline before anything promotes, and secrets are pulled from Secrets Manager at runtime instead of baked into images.
A Spring Boot app with role-based access needed a deploy path that didn't ship known-vulnerable images or hardcoded credentials, but the existing pipeline had no gate for either.
I provisioned ECS, RDS MySQL, and Secrets Manager with Terraform, then built a GitLab CI pipeline where Trivy scans the container image and SonarQube reviews the code before anything promotes to ECS. Application secrets stay in Secrets Manager and get pulled at runtime instead of baked into images or env files.
A deploy pipeline that can't fail on security isn't a pipeline; it's a conveyor belt.
A vulnerable image or a leaked credential now fails the pipeline before it reaches production, without adding a manual review step.
- Terraform-managed ECS, RDS, and Secrets Manager: no click-ops
- Trivy and SonarQube gates block vulnerable builds from promoting
- Secrets pulled at runtime from Secrets Manager, never baked into images