Securing a workload from commit through deployment on AWS — and turning raw scanner output into prioritized, owned remediation work.
Served from a private S3 origin through CloudFront Origin Access Control
A security pipeline that emits thousands of findings has not made anything safer. It has moved the bottleneck from detection to triage. This project treats findings as an engineering workflow: block what should never ship, then rank whatever remains by real exploitability and business exposure, with a named owner and an SLA attached.
SAST quality gate, secret scanning, IaC policy scanning and container CVE scanning — any failure stops the image from being published.
CycloneDX SBOM, SLSA build provenance and keyless cosign signatures bound to the workflow's own OIDC identity.
Kyverno re-checks digest pinning, signature validity and pod hardening at the cluster, so a bypassed pipeline still fails.
GuardDuty threat detection, Inspector image scanning and Security Hub control checks, normalized into one scored ledger.
The same signed container image runs in both places, so every supply-chain control is applied once and inherited by both. The tiers differ in what they exist to prove.
| Tier | Runs | Demonstrates |
|---|---|---|
| Serverless | Always on | Origin access control, least-privilege execution role, concurrency caps, managed TLS |
| Kubernetes | On demand | Admission policy, pod hardening, default-deny networking, IRSA |
The EKS control plane bills a flat hourly rate whether or not it is handling traffic, so it is deployed for evidence-capture sessions and destroyed afterwards. Choosing the cheaper tier as the permanent one, and being able to justify that choice, is part of the point.
Source severity alone makes a poor queue. A CRITICAL on an unreachable internal
service is rarely more urgent than a HIGH that is internet-facing, known to be
exploited and sitting on a revenue path. The scoring engine weighs severity, EPSS,
known-exploited status, internet exposure, asset criticality, fix availability and age —
and emits its reasoning alongside the score, so a human can argue with it.
Open findings from this AWS account's Security Hub, GuardDuty and Inspector, scored by the
risk engine and read from the finding ledger through /api/findings.
Loading…
| Priority | Score | Finding | Source | Owner | SLA |
|---|