cyber.hendryadrian.com
Detection & Defense · aws.amazon.com

How to Gate CI/CD Deployments with AWS Continuum Penetration Tests

· Original article ↗

Summary

AWS explains how to run scoped penetration tests after deployment and block production promotion based on findings, using OIDC authentication and CI/CD pipeline settings. It also warns about baseline advancement and fail-open defaults.

Key points

  • The gate tests changes deployed to staging and can block production promotion when findings meet a configured severity threshold.
  • AWS Continuum scopes each run to changes since the last passing gate; scope conflicts and infrastructure errors have separate handling settings.
  • OIDC federation provides temporary AWS credentials without storing long-lived access keys in CI/CD variables; the article recommends narrowly scoped trust and permissions.
  • A passing report-only run advances the baseline, so later tightening the threshold will not retest changes already cleared.
  • The integration defaults to allowing promotion on infrastructure errors; the article recommends setting fail-on-infrastructure-error to true when security sign-off is required.
  • On GitLab, pipeline variables can override job settings, so teams should restrict who can override variables.

Article Details

Defense Focus
Use scoped penetration tests as a post-deployment CI/CD gate to confirm whether changes introduce exploitable vulnerabilities and prevent promotion when configured criteria are not met.
Detection Methods
  • Run a penetration test against the deployed staging application, scoped to the commit range since the last passing gate.
  • Evaluate validated exploitable findings against a configurable severity threshold.
  • Use dry-run mode to validate authentication, Region, and repository resolution without starting a penetration test job.
  • Review the recorded scope decision and commit range in the Continuum console.
Data Sources
  • The running staging application and the deployed changes in the commit range.
  • Penetration-test findings and scope decisions, including the recorded commit range.
  • CI/CD job results, configuration, and logs.
  • OIDC claims and temporary credentials used by the pipeline.
Platforms
  • GitHub Actions
  • GitLab CI/CD
  • Bitbucket Pipelines
  • Azure DevOps Pipelines
  • AWS
Defensive Actions
  • Run the gate after deployment to staging and require it to pass before promoting to production.
  • Introduce the gate in report-only mode, then raise the severity threshold only after reviewing results; account for the fact that passing runs advance the baseline.
  • Set fail-on-infrastructure-error to true when promotion requires security sign-off, and decide explicitly how scope conflicts should affect promotion.
  • Scope the IAM trust policy narrowly to the pipeline's branch, environment, or repository as supported by the provider, and grant least-privilege permissions.
  • Restrict who can override CI/CD pipeline variables, particularly on GitLab.
  • Keep debug and verbose tracing off for credential-handling steps; avoid persisting source-control credentials and limit OIDC-token access to jobs that need it.
  • Do not run untrusted code in jobs that can read the OIDC token.
  • Pin the integration to an immutable release tag, commit SHA, or component version.
  • Ensure the role's maximum session duration exceeds the gate timeout; use the article's guidance of at least (timeout + 10) × 60 seconds.
  • For a stricter reassessment of a previously cleared commit range, override the head and base commit SHAs or remove the baseline marker.

Vendors

Amazon Web ServicesAWS Continuum for penetration testing (formerly AWS Security Agent) is a service that uses AI agents to find and confirm exploitable vulnerabilities in your running applications.Azure DevOpsWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.BitbucketWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.GitHubWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.GitLabWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.

Products

AWS Continuum for penetration testingAWS Continuum for penetration testing (formerly AWS Security Agent) is a service that uses AI agents to find and confirm exploitable vulnerabilities in your running applications.AWS Identity and Access ManagementThe gate takes three steps to set up: configure a penetration test, create an AWS Identity and Access Management (IAM) role that your pipeline can assume, and add the gate step to your pipeline.AWS STSYour CI/CD provider issues a short-lived token identifying the pipeline, and AWS Security Token Service (AWS STS) exchanges it for temporary credentials when the pipeline assumes an IAM role you create.Azure DevOps PipelinesWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.Bitbucket PipelinesWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.GitHub ActionsWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.GitLab CI/CDWe give a high-level overview of the pattern, which can be applied on four major CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, and Azure DevOps Pipelines.

Related Articles