AWS CodeCommit
Integrate Cortex Cloud Application Security with your AWS CodeCommit version control system (VCS) to enable security scans for exposed secrets, infrastructure-as-code (IaC) misconfigurations, vulnerabilities, package operational risks, and license compliance issues in your repositories. This allows you to analyze, prioritize, and resolve detected issues efficiently.
How the integration works
To ensure security, the platform does not store or use your personal AWS credentials for scanning. Instead, the integration utilizes a cross-account trust relationship through a dedicated IAM Service Role. This relationship is secured using an External ID, a unique security identifier that prevents unauthorized third-party access.
Deployment: You deploy a CloudFormation template provided during onboarding. This template creates the necessary IAM roles and permissions automatically, requiring no manual configuration
The service role: This template creates a specific IAM role for cross-account access that trusts the platform. The trust policy is automatically configured with a unique External ID generated for your tenant. This role follows least privilege principles by requiring only necessary CodeCommit permissions and is limited to the platform AWS account
Auditability: All actions performed by the service role are logged in AWS CloudTrail, providing a permanent audit trail of all repository access and scanning activity for compliance monitoring
Scanning policies: The role includes the required policies for scanning operations and permissions for CodeCommit repository access
Events: The template configures a Simple Notification Service (SNS) topic with an HTTP subscription to the platform webhook URL. The template automatically applies an SNS Access Policy that allows CodeCommit to publish events and authorizes the platform to subscribe to the topic. When code changes occur, this topic pushes a notification to the webhook, triggering the platform to assume the service role and initiate a scan
Data protection
Cortex Cloud ensures the security and integrity of your code:
Isolated scanning: Repository contents are scanned within a strictly isolated sandbox environment to prevent cross-contamination
Tenant isolation: All security findings are stored with tenant isolation to ensure your data remains private and inaccessible to others
No Persistence: No repository credentials or sensitive secrets are stored within the platform infrastructure
Temporary access: Access is managed through secure cross-account IAM role assumption which provides temporary permissions without the need for static keys
Learn more
Last updated
Was this helpful?