Moving security checks left means integrating vulnerability scanners and policy-as-code analyzers directly inside your CI/CD execution pipeline files. This guide details how to build secure workflows.
Static Code Analysis Integration
Integrate static application security testing (SAST) tools like SonarQube or Checkmarx in the early build stages. Configure your pipeline to fail the build if scan results violate the defined security quality gates (e.g. high-severity vulnerabilities or secret values in git commits).
Infrastructure as Code Security Scans
Before applying Terraform plan files to production, run analysis tools such as tfsec or Checkov. These utility scanners check for configuration mistakes, such as open port 22 security groups or unencrypted S3 buckets, directly inside your repository templates.
# Sample GitHub Actions Checkov Step
- name: Run Checkov
uses: bridgecrewio/checkov-action@master
with:
directory: terraform/
framework: terraform
output_format: cliContainer Image Scanning
If your application deploys on Kubernetes, scan container images during the build phase using Trivy or Anchore. Enforce validation policies blocking image registry pushes if base images contain critical unpatched vulnerabilities.