FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
DevSecOps · 01 of 5

Secure pipeline

The gated reference pipeline, controls at every stage and what each check catches.

Gated DevSecOps Pipeline
01

The gated reference pipeline

Static checks first, scanned images, GitOps deploys, DAST on staging and an approval before production. Walk through it.

Gated DevSecOps Pipeline
webhookfindings in the PRsigned imagenew tagsynclogs · metricsfindingsCommitBuild · static checksPackage · scanDeploy · GitOpsAWS CloudOperate · observe and protectDeveloperIDE plug-insPre-commit hookssecrets · unsafe codeGit repositorypull requestAWS CodePipelineor GitLab CI · JenkinsHashiCorp Vaultpipeline secretsSonarQubequality · SASTSnykopen source (SCA)Trivyimage scan · SBOMAmazon ECRsigned imagesAmazon Inspectorre-scans stored imagesConfig repoone folder per envArgo CDGitOps syncAWS Config & SCPscompliance as codeAmazon EKSdev · stagingOWASP ZAPDASTApproval gaterelease ownerAmazon EKSproductionAWS Secrets Managerapp secretsAWS Security Hubfindings per teamPrometheuscluster metricsGrafanadashboardsAmazon CloudWatchlogs · alarmsAmazon GuardDutyruntime threats

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

Point at a component to see what it does; select it for the best practice.Open the architecture
02

Security and testing at every stage

Seven stages, each with a security control and a testing control. The cheapest checks run first.

One standard pipelineevery team, every stack
Step 1 of 7

Plan

Security plan, architecture review, risk analysis and a test plan before the first commit.

Always onSecrets managementCompliance as codeContinuous monitoring
03

What each check catches

Where each check runs, and tools we have used for it in client delivery.

CheckCatchesRunsTools we have used
Pre-commit & IDESecrets, unsafe patternsDeveloper machineGit hooks, IDE plug-ins
Code qualityBugs, smells, low coverageEvery pull requestSonarQube
SASTInjection, insecure code pathsEvery pull requestSonarQube, Coverity, Veracode, FindSecBugs
Dependencies (SCA)Vulnerable or non-compliant librariesEvery buildBlack Duck, Snyk, OWASP Dependency-Check
Container imageVulnerable packages, unsigned imagesBefore the registryTrivy, Twistlock, Clair
Infrastructure as codeInvalid plans, missing backups, cost surprisesBefore applyTerraform validation, approvals, Infracost
DASTRuntime weaknessesTest or stagingOWASP ZAP
Penetration testWhat scans missPlanned with your security teamAuthorised simulated attack
04

Testing on environments built from code

Shift-left testing runs beside shift-left security.

  • Unit and quality on every pull requestThresholds agreed per team and tightened over time.
  • Integration and end-to-endAgainst a deployed environment, not a laptop. Load tests, for example with JMeter, before staging.
  • Short-lived load-test environmentsCreated by Terraform for the run and destroyed after it; cost estimated and approved first.
  • An environment per pull requestWhere the stack allows, as with serverless, each pull request runs in its own isolated environment.
A load-test environment's life
  1. Terraform planits own resource group
  2. Cost estimateapproved before creation
  3. Created from code
  4. Load test runsrelease candidate
  5. Destroyedno bill left behind
SourcesNGT Service Offering v2.0 (Mar 2025)NGT Service Offering v3.2 (Jul 2026)NGT DevSecOps & Cloud Security Service Offering v0.4 (Jan 2025)NGT Cloud Operations Service Offering v0.2 (Jan 2025)NGT Cloud/DevOps/SRE Service Offering (Sep 2026)NGT DevOps-AI Service Offering (Oct 2026)