Skip to main content

AWS Code Build

This article shows you how to integrate Qwiet preZero into your AWS CodeBuild workflow to provide automated code analysis.

Prerequisites​

  • You must have an Amazon Web Services account to proceed. During the registration process, Amazon will ask you to provide your billing information in case you exceed the Free Tier Usage Limits. Qwiet is not responsible for any usage costs you may incur by setting up and using this integration.

  • You can store your source code in any of the four options, but for this tutorial, we will proceed with our HelloShiftLeft sample app source code in GitHub.

Step 1: Create the buildspec file​

In the root of your repository, create a buildspec file, that contains the build commands and related settings that CodeBuild uses to run a build. The following is a sample configuration file that you can modify and include:

version: 0.2

phases:
  install:
    runtime-versions:
      java: corretto8
    commands:
      - echo Entering the install phase...
    finally:
      - echo Exiting the dependency install phase...
  pre_build:
    commands:
      - echo Downloading the Qwiet CLI...
      - curl https://cdn.shiftleft.io/download/sl > $HOME/sl && chmod a+rx $HOME/sl
    finally:
      - echo Downloaded Qwiet...
  build:
    commands:
      - echo Entering the maven build process...
      - mvn clean package
    finally:
      - echo Exiting the maven build process...
  post_build:
    commands:
      - echo Starting code analysis with preZero...
      - $HOME/sl analyze --app HelloShiftLeft --wait --java target/hello-shiftleft-0.0.1.jar
    finally:
      - echo Ran preZero on your code
artifacts:
  files:
    - target/hello-shiftleft-0.0.1.jar

This example uses the corretto8 image; if you opt for a different image, please refer to the information in Prerequisites to ensure that your image is compatible with Qwiet preZero.

Step 2: Create the build project​

  1. Sign in to the AWS Console and open CodeBuild. If this is the first time, you may be asked to choose an AWS Region where CodeBuild is supported; any option is acceptable.

  2. Click Create build project.

  3. Under Project configuration, provide a unique project name.

  4. In Source > Source provider, choose GitHub. Indicate your Repository type (in this case, we chose Public repository), and provide the Repository URL.

  5. AWS CodeBuild needs access to your GitHub account to display the available repositories; CodeBuild will walk you through the authorization process.

  6. Under Environment, choose the Managed image option.

  7. For Operating system, select Ubuntu.

  8. For Runtime, select Standard.

  9. For Image, select aws/codebuild/standard:5.0

  10. For Image version, select Always use the latest image for this runtime version.

  11. For Environment type, select Linux.

  12. For Service role, choose New service role and modify the Role name if you'd like. This will be the "user" role CodeBuild uses to run your build.

  13. Expand the Additional configuration section. Scroll down to the Environment variables and create a SHIFTLEFT_ACCESS_TOKEN variable (for the time being, we will leave them as plaintext for clarity, though you should use parameters or Secret Manager before using this in production). You can create your CI token in the Qwiet Dashboard.

  14. Under Buildspec > Build specifications, choose Use a buildspec file.

  15. Scroll to the bottom, and click Create build project.

Step 3: Run the build​

At this point, you're ready to run your build. You should have been redirected to an overview page for your CodeBuild project; if so, click Start Build. Otherwise, click Build projects in the left-hand navigation bar, and choose your project. Click Start build.

When done, you can review your results in the Qwiet Dashboard.