Secrets in pipelines: what never belongs in a build log - SkilBrill

Skip to content

Home
Courses
About
Contact
Blog
- Freshers

Search for:

Home - Lessons - AWS DevOps Engineering - M6 — Pipeline Security and Supply Chain - Secrets in pipelines: what never belongs in a build log

AWS DevOps Engineering Secrets in pipelines: what never belongs in a build log

AWS DevOps Engineering

0% Completed

M1 — Version Control and Branching for Ops

Repository strategy for application and infrastructure together

Trunk-based development versus release branching and when each fits

Commit standards, hooks and what a review should catch

Change sets and pull requests as the unit of delivery

Tagging, versioning and release notes that mean something

Handling a hotfix without breaking the pipeline

M2 — CI with CodeBuild

Build projects, environments and the buildspec

Caching, artefacts and keeping builds fast

Running tests in build and where they belong

Build environments, privileged mode and the security boundary

Matrices and parallel build strategy

Reading a failing build and fixing it quickly

M3 — CD and Release Strategy

CodePipeline stages and what belongs in each

CodeDeploy: in-place, blue-green and canary hooks

Approval gates: manual, automated and policy-driven

Environment promotion without configuration drift

Feature flags and decoupling deploy from release

Rollback: automatic, manual and what you rehearse

M4 — Infrastructure as Code with CloudFormation

Stacks, change sets and the drift detection workflow

Parameters, mappings, conditions and pseudo parameters

Nested stacks and cross-stack references

Custom resources and Lambda-backed extensions

Stack policies, termination protection and safe deletion

Refactoring a 3,000-line template without an outage

M5 — Advanced IaC: CDK and Drift Control

Why synthesised templates change how you structure code

Constructs, stacks and environment separation in the CDK

Writing constructs a team will actually reuse

Testing infrastructure code before it reaches an account

Drift: detection, remediation and deciding when drift is fine

CI for infrastructure: pipeline changes that touch stacks

M6 — Pipeline Security and Supply Chain

Secrets in pipelines: what never belongs in a build log

IAM roles for pipelines and the least-privilege question

Artefact integrity: ECR scanning, signing and provenance

Dependency and image vulnerability gating

OIDC federation from the pipeline instead of long-lived keys

Auditing who shipped what, when, and on whose approval

M7 — Testing and Quality Gates

Unit, integration and end-to-end tests in a delivery pipeline

Test environments that resemble production enough to matter

Static analysis, linting and policy checks as gates

Performance and smoke checks before traffic moves

Balancing gate coverage against lead time

Flaky tests: why they destroy trust in a pipeline

M8 — Capstone: A Full Delivery System

Build the repository, branching and review workflow

Create the build and test pipeline with a security gate

Model the infrastructure in CDK or CloudFormation

Implement progressive delivery with a rehearsed rollback

Add artefact scanning and policy enforcement

Hand the system to another team and support their first release

Announcements Course Info

Global Trusted Software Training Partner Since 2022

SkilBrill Training Institute delivers industry-focused technology education that bridges the gap between academic learning and real-world demands. Our structured programs combine foundational theory with practical application, ensuring every graduate is confident and job-ready from day one.

Learn More About Us

© 2026 SkilBrill Training Institute. All Rights Reserved. Privacy Policy Terms Refunds Outcomes

📞 Enroll Now

Start Your Journey

Fill in your details and our team will get back to you within 24 hours

Please enable JavaScript in your browser to complete this form.

Full Name *

Email *

Course Interested In *

Mode of Course *