AWS Cloud Native CI/CD Pipeline
An all-AWS-native delivery pipeline for a containerized streaming app, where CodePipeline only rolls out to ECS after SonarCloud and Trivy both pass on the exact image being deployed.
A containerised streaming app shipped without a consistent path from commit to production. Security checks, when they ran at all, happened only after the image reached the registry.
I built the delivery flow entirely on AWS-native services. CodePipeline orchestrates the stages. CodeBuild runs the build alongside SonarCloud for static analysis and Trivy for the image scan. CodeDeploy rolls the image onto ECS only after both scans pass. Images live in ECR with Docker Hub as a mirror, so the deploy artefact is the exact one that was scanned.
A pipeline that scans after deploy is just a report generator.
Every deploy to ECS now comes with a fresh SAST and container scan attached to it. The build fails loudly if either scan turns up something serious.
- SonarCloud and Trivy gate the pipeline before an image ever reaches ECS
- Same image scanned in CodeBuild is the one CodeDeploy rolls out
- Entirely AWS-native: no self-hosted runners or bespoke glue