Best Practice: Vulnerability & Patch Management

resource "aws_ecr_repository" "payment_service" {
  name                 = "payment-service"
  image_tag_mutability = "IMMUTABLE"  # Tags cannot be overwritten

  image_scanning_configuration {
    scan_on_push = true  # Automatic scanning on every push
  }

  encryption_configuration {
    encryption_type = "KMS"
    kms_key         = aws_kms_key.ecr_cmk.arn
  }

  tags = {
    owner       = "payment-team"
    environment = "production"
    workload    = "payment-service"
  }
}

# Lifecycle policy: automatically delete old images
resource "aws_ecr_lifecycle_policy" "payment_service" {
  repository = aws_ecr_repository.payment_service.name

  policy = jsonencode({
    rules = [
      {
        rulePriority = 1
        description  = "Keep only the last 10 images per tag"
        selection = {
          tagStatus   = "tagged"
          countType   = "imageCountMoreThan"
          countNumber = 10
        }
        action = { type = "expire" }
      },
      {
        rulePriority = 2
        description  = "Delete untagged images after 7 days"
        selection = {
          tagStatus     = "untagged"
          tagPrefixList = []
          countType     = "sinceImagePushed"
          countUnit     = "days"
          countNumber   = 7
        }
        action = { type = "expire" }
      }
    ]
  })
}

# GitHub Actions workflow – container security scanning
name: Container Build & Scan

on:
  push:
    paths: ['Dockerfile', 'src/**']

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker Image
        run: docker build -t payment-service:${{ github.sha }} .

      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: payment-service:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1  # Pipeline fails on CRITICAL/HIGH

      - name: Upload Trivy Results to Security Hub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

      - name: Scan with Grype (second opinion)
        run: |
          grype payment-service:${{ github.sha }} \
            --fail-on critical \
            --output json \
            > grype-results.json

# Good example: distroless, specific digest
FROM gcr.io/distroless/java21-debian12:nonroot@sha256:a1b2c3d4e5f6...

# Bad example: mutable tag, many packages
# FROM openjdk:latest

resource "aws_imagebuilder_image_pipeline" "payment_base" {
  name             = "payment-service-base-ami"
  image_recipe_arn = aws_imagebuilder_image_recipe.payment_base.arn
  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.main.arn

  schedule {
    schedule_expression                = "cron(0 2 ? * SUN *)"  # Every Sunday at 02:00
    pipeline_execution_start_condition = "EXPRESSION_MATCH_ONLY"
  }

  image_tests_configuration {
    image_tests_enabled = true
    timeout_minutes     = 60
  }
}

- name: Generate SBOM with Syft
  run: |
    syft payment-service:${{ github.sha }} \
      -o spdx-json=sbom.spdx.json \
      -o cyclonedx-json=sbom.cyclonedx.json

- name: Store SBOM as Artifact
  uses: actions/upload-artifact@v4
  with:
    name: sbom-${{ github.sha }}
    path: |
      sbom.spdx.json
      sbom.cyclonedx.json
    retention-days: 365  # Compliance: retain SBOM for 1 year

- name: Attestation with Cosign (SLSA L2)
  run: |
    cosign attest \
      --predicate sbom.spdx.json \
      --type spdxjson \
      payment-service:${{ github.sha }}

# .github/dependabot.yml
version: 2
updates:
  # Python dependencies
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    groups:
      security-patches:
        patterns: ["*"]
        update-types: ["patch"]

  # Docker base images
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

# Check whether current CVEs are on the CISA KEV list
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq '.vulnerabilities[] | select(.cveID == "CVE-2021-44228")'