What is aws-devsecops-pipeline?

This project is an example setup that shows how a company might automatically check code for security problems before letting it go live. It includes a small Java web application, but the real focus is the pipeline built around it: every time code is pushed to the main branch, a sequence of automated checks runs before anything is deployed to the cloud. Three security tools run in order. First, a tool called GitLeaks searches the entire history of the code for accidentally committed passwords, API keys, or other secrets. Second, a dependency checker scans every library the project uses against a public database of known vulnerabilities, and stops the pipeline if anything scores high enough to be considered a serious risk. Third, once the application is packaged into a container image, another tool called Trivy scans that image itself for known security flaws. If any of these three checks fail, the deployment is blocked and nothing reaches the live server. The README includes a real example of the pipeline catching Log4Shell, a well known and severe vulnerability that affected many servers in 2021, showing that the setup would have stopped it before deployment. The infrastructure itself, meaning the servers, network, and load balancer the application runs on, is defined as code using Terraform, so the entire cloud environment can be created or torn down with a couple of commands rather than being clicked together manually in a web console. Everything is hosted on Amazon Web Services, with the automated checks and deployment steps running through GitHub Actions whenever code is pushed. This is meant for developers or teams who want a working reference for adding automated security scanning into their own deployment pipeline, and it requires an AWS account, Terraform, Docker, and Java to set up.