Scanning Code and Container Images in the Pipeline

The previous lesson built an ML CI/CD pipeline with CodePipeline, CodeBuild and CodeDeploy, and added rollback triggers that protect production from a model that predicts badly. Those triggers do nothing about a serving image that ships a known vulnerability. CodeArtifact, covered in the lesson on secure dependencies, controls where packages come from; scanning checks what actually ends up in the code and the inference image.

This lesson adds two security checks to that pipeline: code is reviewed for security defects before it merges, and every container image is scanned before the Deploy stage can use it. You will learn how Amazon ECR enhanced scanning and Amazon Inspector work, how to fail a pipeline on vulnerabilities, and where Amazon CodeGuru Reviewer fits.

The diagram below shows where each check sits in the pipeline from the previous lesson.

Container image scanning with Amazon Inspector

Amazon ECR offers two scan types, set once for the whole private registry. The following table compares them:

Enhanced scanning is the right choice for ML images, because most of their risk sits in language packages such as numpy, torch or the web server that wraps the model. The ...