Code-to-Cloud Security Control Plane

Securing a workload from commit through deployment on AWS — and turning raw scanner output into prioritized, owned remediation work.

Served from a private S3 origin through CloudFront Origin Access Control

The problem this addresses

A security pipeline that emits thousands of findings has not made anything safer. It has moved the bottleneck from detection to triage. This project treats findings as an engineering workflow: block what should never ship, then rank whatever remains by real exploitability and business exposure, with a named owner and an SLA attached.

Controls in the delivery path

Build

SAST quality gate, secret scanning, IaC policy scanning and container CVE scanning — any failure stops the image from being published.

Supply chain

CycloneDX SBOM, SLSA build provenance and keyless cosign signatures bound to the workflow's own OIDC identity.

Admission

Kyverno re-checks digest pinning, signature validity and pod hardening at the cluster, so a bypassed pipeline still fails.

Runtime

GuardDuty threat detection, Inspector image scanning and Security Hub control checks, normalized into one scored ledger.

Two compute tiers, deliberately

The same signed container image runs in both places, so every supply-chain control is applied once and inherited by both. The tiers differ in what they exist to prove.

TierRunsDemonstrates
Serverless Always on Origin access control, least-privilege execution role, concurrency caps, managed TLS
Kubernetes On demand Admission policy, pod hardening, default-deny networking, IRSA

The EKS control plane bills a flat hourly rate whether or not it is handling traffic, so it is deployed for evidence-capture sessions and destroyed afterwards. Choosing the cheaper tier as the permanent one, and being able to justify that choice, is part of the point.

Risk scoring

Source severity alone makes a poor queue. A CRITICAL on an unreachable internal service is rarely more urgent than a HIGH that is internet-facing, known to be exploited and sitting on a revenue path. The scoring engine weighs severity, EPSS, known-exploited status, internet exposure, asset criticality, fix availability and age — and emits its reasoning alongside the score, so a human can argue with it.

Live triage queue

Open findings from this AWS account's Security Hub, GuardDuty and Inspector, scored by the risk engine and read from the finding ledger through /api/findings.

Loading…

AWSTerraformEKS LambdaCloudFrontKyverno cosignTrivyCheckov SonarQubeSecurity HubGuardDuty