Welcome to 'This is My Architecture'. Customer, Snyk, AWS.
I'm Lana with AWS, and today we're talking with Jay from Snyk.
Hey Jay. Hey Lana.
Thank you for coming down.
Would you mind telling us about Snyk? Sure.
Snyk is a developer first application security company
providing security controls within the tools that developers are using today
to build their modern applications.
CICD pipelines are at the heart of a development cycle.
So how can we use, me as a developer Snyk as a part of code pipeline on AWS?
Great question.
So the sneak action type is available to developers
today that are using the code pipeline service as a free integration
that they can simply use a pull down menu
and enable right within their code pipeline service.
And how is this action different from let's say,
pulling down your source code from a Repo.
So the neat thing about this integration is that we heard our customer's cry.
Developers are always wanting to work fast, develop fast,
and the last thing they wanna do is be burdened
with additional tooling or anything like that.
So this integration provides security controls, right within that experience
without developers having to leave the AWS console.
And why is it important to scan for vulnerabilities as a part of your build?
Yeah, that's a great question.
So we've published a security report that pulled a number of different respondents.
And what we found was that vulnerabilities are growing in the past three years
by a rate of two and a half times.
So we're anticipating that in the next four years or so,
70% of vulnerabilities are gonna affect containers
and misconfigurations of those as well.
So it's crucial for developers to have actionable insights early in the process
or shift left in order to avoid those pitfalls down the road.
Gotcha.
So I select a new action type, which is a Snyk check.
What happens next?
Right, so what happens next is the Code Pipeline service
is going to direct the customer to our API Gateway, running on the Snyk infrastructure.
At that endpoint, we're going to authenticate the customer.
If they're a new customer, it happens immediately.
If they're an existing customer, they can authenticate.
And then some additional metadata is going to be processed
into our DynamoDB table,
where we're gonna make the association of that customer with the Code Pipeline,
the specific pipeline and code pipeline that they're using.
So we're pulling in the artifacts from the S3 bucket,
and we are scanning them for vulnerabilities? Right.
So that's the first flow for this integration, which is initial setup and then configuration.
The customer's gonna select a few options for how they want their integration to behave,
things like whether they want to fail the build, if there's any vulnerabilities
or if they're developing, and they just wanna explore, they can opt out of that.
But after that happens, any subsequent run from the customer's pipeline
through this Code Pipeline service is going to interact directly
with our AWS Lambda
that's sitting in our infrastructure.
That Lambda function is going to write some information into EventBridge,
that's gonna capture state and things like that.
And then a series of additional Lambda functions that are in Step Functions
are gonna go through the complex logic
of determining which customer's pipeline
is associated with our configuration information,
where the objects are,
the artifacts that we're gonna be scanning.
So as part of this integration, the Code Pipeline service is going to take
the source code that's in their SCM,
and it's going to create a copy of that in an S3 bucket in the customer's account.
These Step Functions will then consume that artifact
and then go through a series of steps on whether we're doing a full scan,
whether we're doing partial scans, things like that.
And what we're doing is we're looking for the package or the manifest files
package.JSON if it was a node app.
And we're going to look through what vulnerabilities are potentially there
from some of the open source dependencies that are the customer's source code.
And we've got some results, let's say, how do I remediate
or what do I do with this information that is now in my S3 bucket?
Right, so the report is going to be provided to the customer
within the Code Pipeline service, where they can see an HTML rendered report
on what those vulnerabilities are.
Now, if you're a Code Pipeline customer today, you have a number of different options
for which SCM products you happen to use.
It could be CodeCommit, it could be Atlassian Bitbucket or GitHub.
We have integrations with each of those SCMs as well.
And what happens is that a developer that's using,
let's say Atlassian Bitbucket as an example.
They're able to then submit fixed pul requests through Snyk
to their Bitbucket repository so that they can remediate those vulnerabilities.
Once they've committed that through that integration,
the next pipeline run will trigger another scan of their source code.
And the idea here is to iteratively go through and pay down
some of the technical debt with some of the vulnerabilities that we're finding,
so that you're confident that the application you're deploying
is not gonna contain any vulnerabilities. Awesome.
Jay, thank you so much for coming down today
and telling us a little bit more of how to make our code more secure
and easier to use for developers.
Thank you, Lana.
And thank you for watching 'This is My Architecture'.