AWS CodeBuild

AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces ready-to-deploy software packages. Integrated into your development pipeline, AWS CodeBuild automates the build process, enabling developers to efficiently produce reliable and consistent builds, ultimately facilitating faster and more reliable software delivery to AWS environments.

This how-to will provide a basic understanding of how to create the Relyance Source Code inspector (SCI) build job.

Prerequisites:

1. A source code repository needs to be available in AWS CodeCommit.
2. The relyance.yaml file needs to be in the source code root directory.
3. Grab the command line code from Step 2 of the Relyance Source Code Integration settings from your Relyance instance.

See more info about the SCI commands here.

Steps:

In AWS CodeCommit:

Add a buildspec configuration file in AWS CodeCommit.

1. Login to your AWS management console.
2. Navigate to the main page of your AWS CodeCommit repository.
3. Ensure your source code repository has the preconfigured relyance.yaml file in the root path of your source code.
4. Create a new file in the repository root named 'buildspec_relyance.yml'.
5. Using the template below, create the buildspec configuration file:

version: 0.2

phases:
  build:    # TODO: Update the docker pull command in the "run" section below.     # Recommend setting the API_KEY as an environment secret variable.
    commands:
      - echo "Relyance Scan"      - docker pull gcr.io/relyance-ext/compliance_inspector:release       - docker run --rm -v `pwd`:/repo --env "API_KEY=example:abcdefg0123456789abcdefg0123456789abcdefg" gcr.io/relyance-ext/compliance_inspector:release

Use the Step 2 docker pull/docker run commands from your Relyance AI tenant on the last two lines. 6. Save the file and commit the changes.

In AWS CodeBuild:

Create the build project in AWS CodeBuild.

1. Navigate to the AWS CodeBuild section and go to the Build projects page.
2. Click Create build project.
3. In the project name provide a meaningful name (e.g. RelyanceScan).
4. In the Source section select the CodeCommit source code repository you wish to scan.
5. In the Environment section use the follow values: Environment Image: Managed Image Compute: EC2 Operating system: Ubuntu Runtime: Standard Image: aws/codebuild/standard:7.0 Image version :Always use the latest image for this runtime version Service role: New Service role Role name: Provide a meaningful name (e.g. codebuild-RelyanceScan-service-role)
6. Specify the Buildspec configuration file that was created in code repository (i.e. buildspec_relyance.yml ).
7. Once filled out click the Create build project button at the bottom of the page.
8. Once created, use the Start build button to test the scan.
9. If there are no errors, you should start to see SCI results in your Relyance tenant. Scheduling the scan
10. Once this passes, you can create a build trigger to schedule the scan. Go into your newly created build project and select Build triggers.
11. Click the Create trigger button.
12. Fill out the form as desired:
13. Once the desired frequency is set, save the trigger.

Appendix:

Source Code Integration Step 2 info:

Example Step 2 Command

1. This command pulls the latest version of the Relyance Source Code Inspector.
2. This command initiates the Relyance Source Code Inspector within a local Docker container, establishing a shared folder and providing the necessary tenant API credentials.