Module 5 of 5
Delivery and operations
How a workload gets from a commit to a cluster without anyone swapping it on the way, and what to do when an identity is used by someone it should not be.
The earlier modules make a running workload hard to abuse. This one covers the two places where that work is most often undone: the delivery pipeline that builds and ships the workload, and the operations that notice when something has gone wrong anyway. A CI system holds more authority than most production services, and a stolen session credential can mint new ones faster than a responder reads the alert.
The four lessons follow an artifact and then an incident: treating CI as a privileged system and proving where a build came from, signing images and enforcing identity at admission, collecting audit logs and writing detections that people act on, and scoping and containing a compromised cloud identity. By the end of it you should be able to say which build produced the code that is running, who was allowed to sign it, and, when a credential leaks, exactly which sessions and resources to cut off first.
Lessons
- 5.aCI/CD and build provenanceHow do you keep a build pipeline from being the easiest way in, and prove where an artifact came from?20 min
- 5.bSigning and admissionHow do you make a cluster run only images that your release pipeline signed?21 min
- 5.cAudit logs and detectionWhat should you log, how do you keep it trustworthy, and which detections are worth waking someone for?18 min
- 5.dContaining an incidentWhen a cloud identity is compromised, how do you find everything it reached and shut it down without destroying the evidence?18 min