How to add an infra test stage in CDK pipelines

Question

Hello everyone, I have a working CDK pipeline which deploys few services. I want to add a stage where the stack is checked for linting, sensitive leaks, security scan etc. 
This seems to be possible while working with codebuild, codepipeline, codedeploy but I am not sure how to do it using CDK pipelines? I don't see an edit option once the CDK pipeline is deployed.
Ideally, at any stage, before deploying the stack, I would like to add a stage of testing using CDK pipelines. 
Please share if you have any ideas or if you have done something similar. Thanks in advance.

Answer

Add CodeBuild Projects for Testing: Create CodeBuild projects to run your linting, security scans, and other tests. These projects will contain the necessary build specifications or scripts to perform the tests.

Modify Your CDK Pipeline Code: Update your CDK pipeline code to include additional stages for testing before deploying your stacks. You can use the CdkPipeline.addStage() method to add these stages to your pipeline.

Define Testing Stages: Define stages in your CDK pipeline for linting, security scanning, etc., and add actions that trigger the corresponding CodeBuild projects.
You can indeed integrate testing stages, such as linting, security scanning, and vulnerability checks, into your CDK pipelines using AWS CodePipeline along with other AWS services like AWS CodeBuild for running tests.

Here's a general approach to achieve this:

Add CodeBuild Projects for Testing: Create CodeBuild projects to run your linting, security scans, and other tests. These projects will contain the necessary build specifications or scripts to perform the tests.

Modify Your CDK Pipeline Code: Update your CDK pipeline code to include additional stages for testing before deploying your stacks. You can use the CdkPipeline.addStage() method to add these stages to your pipeline.

Define Testing Stages: Define stages in your CDK pipeline for linting, security scanning, etc., and add actions that trigger the corresponding CodeBuild projects.

Here's a simplified example using AWS CDK:

import * as codepipeline from '@aws-cdk/aws-codepipeline';
import * as codepipeline_actions from '@aws-cdk/aws-codepipeline-actions';
import * as codebuild from '@aws-cdk/aws-codebuild';
import * as cdk from '@aws-cdk/core';

const app = new cdk.App();

const pipeline = new codepipeline.Pipeline(app, 'MyPipeline', {
  pipelineName: 'MyPipeline',
});

// Define source action
const sourceOutput = new codepipeline.Artifact();
const sourceAction = new codepipeline_actions.GitHubSourceAction({
  actionName: 'GitHub_Source',
  output: sourceOutput,
  owner: 'OWNER',
  repo: 'REPO',
  oauthToken: cdk.SecretValue.secretsManager('GitHubToken'),
  branch: 'main',
});

pipeline.addStage({
  stageName: 'Source',
  actions: [sourceAction],
});

// Define test stage
const testStage = pipeline.addStage({ stageName: 'Test' });

// Define linting action
const lintingProject = new codebuild.PipelineProject(app, 'LintingProject', {
  buildSpec: codebuild.BuildSpec.fromObject({
    version: '0.2',
    phases: {
      install: {
        commands: ['npm install -g eslint', 'npm install'],
      },
      build: {
        commands: ['eslint .'],
      },
    },
  }),
});
const lintingAction = new codepipeline_actions.CodeBuildAction({
  actionName: 'Linting',
  project: lintingProject,
  input: sourceOutput,
});
testStage.addAction(lintingAction);

// Define security scan action (example)
const securityScanProject = new codebuild.PipelineProject(app, 'SecurityScanProject', {
  // Define project for security scan
});
const securityScanAction = new codepipeline_actions.CodeBuildAction({
  actionName: 'SecurityScan',
  project: securityScanProject,
  input: sourceOutput,
});
testStage.addAction(securityScanAction);

// Define deployment stage
const deployStage = pipeline.addStage({ stageName: 'Deploy' });
// Define deployment actions...

app.synth();

In this example, we've added a Test stage to the pipeline with linting and security scan actions. You can define your CodeBuild projects (LintingProject, SecurityScanProject, etc.) with the necessary configurations to run your tests.

Once you've made these changes, you can redeploy your CDK stack to update your pipeline with the new testing stages. Keep in mind that you may need to adjust the specifics based on your actual testing requirements and tools used for linting, security scanning, etc.

How to add an infra test stage in CDK pipelines

Relevant content