AWS Serverless Lambda Deployment via CI/CD
A Jenkins pipeline that gates Lambda deploys on Bandit and cfn-nag, then rolls out with CodeDeploy's linear traffic shift so a bad release gets caught before it reaches everyone.
Lambda functions were being updated straight from developer laptops, which meant no consistent review of the Python code or the CloudFormation that defined the runtime around it.
I moved the whole thing behind a Jenkins pipeline: Bandit scans the function source for common Python security issues, cfn-nag scans the CloudFormation template for misconfigured IAM and resource policies, and only after both pass does CodeDeploy roll the new version out with a linear traffic shift so a bad deploy can be caught before it takes the whole function.
Serverless doesn't mean review-less.
Lambda changes now ship through the same reviewed, scanned path as everything else, and a rollback is one CodeDeploy action away instead of a rescue operation.
- Bandit and cfn-nag both gate the pipeline before any deploy runs
- CodeDeploy shifts traffic gradually so a bad release is caught early
- CloudFormation is the single source of truth for the function's environment