AWS Cloud Native CI/CD Pipeline
An all-AWS-native delivery pipeline for a containerized streaming app, where CodePipeline only rolls out to ECS after SonarCloud and Trivy both pass on the exact image being deployed.
A containerised streaming app was being shipped without a consistent path from commit to production, and security checks, if they ran at all, happened after the image was already in a registry.
I built the delivery flow entirely on AWS-native services: CodePipeline orchestrates the stages, CodeBuild runs the build alongside SonarCloud for static analysis and Trivy against the resulting image, and CodeDeploy rolls it onto ECS only after the scans pass. Images live in ECR with Docker Hub as a mirror, so the deploy artefact is the exact one that was scanned.
A pipeline that scans after deploy is just a report generator.
Every deploy to ECS now comes with a fresh SAST and container scan attached to it, and the build fails loudly if either turns up something serious.
- SonarCloud and Trivy gate the pipeline before an image ever reaches ECS
- Same image scanned in CodeBuild is the one CodeDeploy rolls out
- Entirely AWS-native: no self-hosted runners or bespoke glue