Welcome to 'This is My Code'. I'm Boaz.
And I have here with me Shay from Checkmarx.
- Hi, Shay. - Hi, Boaz.
Tell us a bit about Checkmarx.
Checkmarx is an application security company,
empowering the developers, helping them deliver secure code.
And we have an example here that is talking about
one of your CI/CD pipelines.
Tell us a bit about what you are trying to achieve here.
So our focus is to make Checkmarx products available
as a service over the cloud.
And using CI/CD pipelines
is an integral part of succeeding with that.
So you choose a relatively new technology
called the CDK.
Can you tell us a bit about CDK?
Sure.
CDK stands for Cloud Development Kit.
It's an open source framework, software development framework
that basically allows you to use high-level language of your choice,
and provision and model your cloud application resources.
Any specific reasons why did you choose it?
We mainly chose CDK
because of the construction that it provides us.
CDK allows us to define and provision our cloud resources
with ease.
So it gives us safe defaults as well, which is very important for us.
So we know that with CDK, the cloud resources that we provision,
by default will come with the right values that we expect
and not over expose those resources.
Okay.
So we have here an example of part of your CI/CD pipeline.
- Can you walk us through? - Sure.
So what we see here is basically a CDK construct.
Construct in CDK represents a cloud component.
It can be made of single resource
or maybe more resources in a single construct,
and it allows us to, basically, reuse it whenever we want.
In this case,
what we see is a CodeBuild project
that we define.
CodeBuild is an AWS Serverless build environment.
- Okay.
We start off by defining the GitHub source.
So we pass over to that source some metadata
such as what is our repository,
and then whether we want to add a webhook.
The important part here is basically this filter,
which says,
only trigger this build environment whenever a pull request is being created
on this specific branch.
So this is taking, basically,
giving the basic definitions of a GitHub repository
and making sure to run on your pull request
and not on anything else.
- Correct. - Okay.
We then need to authorize build...
CodeBuild need to authorize itself against GitHub.
So what we do here is we read from Secrets Manager,
a sensitive secret.
We leverage CDK here by...
CDK by itself will add the needed permissions for it
to access...
For CodeBuild to access Secrets Manager,
retrieve the GitHub token from it.
And then we pass it over to the build environment
as an environment variable.
So this part basically ensures that you're not storing any credentials,
any secret data inside your code and...
- Correct.
Potentially expose it to people that not supposed to get it.
Okay.
So this is basically preparing your pipeline.
We're just defining here,
components that are going to be reused later on, on the next slide,
which actually is going to build the pipeline itself.
Let's talk about it.
So what we do here on this slide is actually creating
the CodeBuild project.
So we give it a name.
And then we pass over the source that we created previously.
You will define a buildspec.
So whenever the build environment will clone the repository,
it will look for a buildspec.yaml file,
which contains all the instructions and all the logic
of what we actually want to test within that validation phase.
So the idea here is that
whenever this is triggered upon a pull request,
we want to make sure that the pull request itself
is that we are okay with,
and that it fits all the standards that we have.
And this is implemented within the buildspec file.
In here, we can see that we get to choose
the type of image CodeBuild will run on,
in this case, Amazon Linux 2.
We run it in a privileged mode,
which allows us to actually run containers
inside the CodeBuild environment.
And then we get to choose the ComputeType as well.
So because the pipeline is using the CodeBuild
and CodeBuild is a service environment,
you need to define how to actually build this environment each time from scratch.
So you're getting a fresh environment.
Your YAML file is basically a spec saying
what are the different steps in your build process.
- Exactly. - Okay.
What we do here is again,
adding permissions for the build environment
to fetch parameters from parameter store, system manager.
The reason we do that because within the buildspec,
one of the instruction says,
let me read in runtime whenever the build environment starts,
read some parameters from parameters store.
So using CDK, we actually give it the needed permissions,
and then we just return the CodeBuild project.
So simplicity is pretty quickly obvious,
any other advantages for developers moving to this technology?
Yeah, so mostly,
the fact that the adoption speed of our developers is fast
due to the reason that CDK lets you write
your own language.
So we use the same language that we write our application in.
We also write the infrastructure and CDK in the same language.
So the adoption is quite easy for our developers.
Yeah.
So don't need to learn new structures of YAML
for using CloudFormation...
Exactly.
No domain specific language, only the language they already know.
So that's great.
So this is just one example of building CI/CD pipeline.
Any other examples that you use CDK inside Checkmarx?
Yeah.
So we use CDK for other modules, other components that we have.
One of them being Step Functions, we define using CDK, a state machine,
which includes inside a full orchestration
of a workflow that we have.
And then inside it includes many step functions.
And then each step function builds up like a Lambda function.
And then that Lambda function is talking to an SQS queue
and so on and so on.
So all of that is being defined and provisioned using CDK as well.
And once again, same language for the developer
without learning the JSON of first Step Function
or YAML of a CloudFormation?
- Exactly. - Same environment, same code.
Exactly.
Okay, so this is a great example of CDK.
Thank you very much for walking us through.
Thank you.
And thank you very much for watching 'This is My Code.'