deploy-stack 0.5.0 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/src/commands/init.js

@@ -261,6 +261,11 @@ export async function mainStack() {
     outro(`
     ${color.green('✅ Project provisioned successfully!')}
 
+    ${color.blue('🛡️ DevSecOps Enabled:')}
+       Automated Trivy vulnerability scanning for your Docker container 
+       and Terraform has been added to your CI/CD pipeline. 
+       Check the 'Summary' page of your GitHub Actions runs for reports.
+
     ${frameworkWarnings}
     
     Next steps:

package/templates/README.md

@@ -96,4 +96,15 @@ Make sure your app is configured correctly:
 
 If you are deploying a static site, your application is served via a highly optimized, unprivileged Nginx container. 
 * **Zero-Config Build:** The CLI automatically detected your framework's output folder (`dist`, `build`, etc.) and pre-configured your Dockerfile. 
-* **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
+* **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
+
+## 🛡️ Security Scanning
+
+This pipeline includes automated DevSecOps guardrails using [Trivy](https://trivy.dev/). 
+Every time you push code, the pipeline will scan both your Docker container and your 
+Terraform configurations for vulnerabilities and misconfigurations. 
+
+To view the security reports:
+1. Navigate to the **Actions** tab in GitHub.
+2. Click on the latest deployment run.
+3. Scroll down the **Summary** page to view the generated vulnerability tables.

package/templates/docker/nextjs.Dockerfile

@@ -21,10 +21,17 @@ ENV NODE_ENV=production
 ENV PORT={{PORT}}
 ENV HOSTNAME="0.0.0.0"
 
-# Copy the standalone output from the builder stage
-COPY --from=builder /app/.next/standalone ./
-COPY --from=builder /app/.next/static ./.next/static
-COPY --from=builder /app/public ./public
+# Create an unprivileged user and group
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nextjs -u 1001 -G nodejs
+
+# Copy the standalone output and assign ownership to the unprivileged user
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Switch to the unprivileged user before executing
+USER nextjs
 
 EXPOSE {{PORT}}
 

package/templates/docker/node.Dockerfile

@@ -5,16 +5,14 @@ ENV NODE_ENV=production
 
 WORKDIR /app
 
-# 2. Copy only dependency files first to cache the npm install layer
-COPY package*.json ./
+# 2. Copy dependency manifests with non-root ownership
+COPY --chown=node:node package*.json ./
+RUN npm ci --omit=dev
 
-# 3. Use npm ci for strict, deterministic, and faster CI/CD installs
-RUN npm ci
+# 3. Copy application code with non-root ownership
+COPY --chown=node:node . .
 
-# 4. Copy the rest of the application source code
-COPY . .
-
-# 5. DevSecOps best practice: do not run the container as root
+# 4. DevSecOps best practice: do not run the container as root
 USER node
 
 EXPOSE {{PORT}}

package/templates/docker/python.Dockerfile

@@ -13,10 +13,8 @@ RUN adduser --disabled-password --gecos '' appuser
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
-
-# Secure file permissions
-RUN chown -R appuser:appuser /app
+# Copy with ownership
+COPY --chown=appuser:appuser . .
 
 # Drop root privileges
 USER appuser

package/templates/docker/static.Dockerfile

@@ -11,7 +11,7 @@ COPY . .
 RUN npm run build
 
 # STAGE 2: Serve with Hardened Nginx
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:alpine
 
 # Adjusts BUILD_DIR to match your framework's output folder
 COPY --from=builder /app/{{BUILD_DIR}} /usr/share/nginx/html
@@ -28,18 +28,5 @@ RUN echo "server {" > /etc/nginx/conf.d/default.conf && \
     echo "    }" >> /etc/nginx/conf.d/default.conf && \
     echo "}" >> /etc/nginx/conf.d/default.conf
 
-# Silence unprivileged user directive warning in main config
-RUN sed -i 's/^user\s\+nginx;/# user nginx;/' /etc/nginx/nginx.conf
-
-# DevSecOps Hardening: Drop root privileges for the Nginx process
-RUN chown -R nginx:nginx /usr/share/nginx/html && \
-    chown -R nginx:nginx /var/cache/nginx && \
-    chown -R nginx:nginx /var/log/nginx && \
-    chown -R nginx:nginx /etc/nginx/conf.d && \
-    touch /var/run/nginx.pid && \
-    chown -R nginx:nginx /var/run/nginx.pid
-
-USER nginx
-
 EXPOSE {{PORT}}
 CMD ["nginx", "-g", "daemon off;"]

package/templates/github/deploy.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - {{DEPLOY_BRANCH}}
+    schedule:
+    - cron: '0 0 * * 0'
 
 env:
   AWS_REGION: {{REGION}}
@@ -24,6 +26,29 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
 
+      # --- 1. IaC SECURITY SCAN ---
+      - name: Scan Terraform for Misconfigurations
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: 'terraform/'
+          scanners: 'vuln,secret,misconfig'
+          format: 'table'
+          exit-code: '0' # Informational only, will not break the build
+          severity: 'CRITICAL,HIGH'
+          output: 'trivy-iac-summary.txt'
+
+      - name: Publish IaC Summary
+        if: always()
+        run: |
+          if [ -f trivy-iac-summary.txt ]; then
+            echo "### 🏗️ Terraform Misconfiguration Scan" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-iac-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 2. DEPLOYMENT PREP ---
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -34,13 +59,43 @@ jobs:
         id: login-ecr
         uses: aws-actions/amazon-ecr-login@v2
 
-      - name: Build, tag, and push image to Amazon ECR
+      # --- 3. BUILD ---
+      - name: Build Docker image
         id: build-image
         env:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           IMAGE_TAG: latest
         run: |
           docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
+
+      # --- 4. CONTAINER SECURITY SCAN ---
+      - name: Scan Container for Vulnerabilities (SARIF Output)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest'
+          format: 'table'
+          output: 'trivy-container-summary.txt'
+          exit-code: '0' # Informational only, will not break the build
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Publish Container Summary
+        if: always()
+        run: |
+          if [ -f trivy-container-summary.txt ]; then
+            echo "### 🛡️ Container Security Scan Results" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-container-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 5. DEPLOY ---
+      - name: Push image to Amazon ECR
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: latest
+        run: |
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
           echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
 

package/templates/terraform/cloudfront.tf

@@ -8,6 +8,7 @@ data "aws_cloudfront_origin_request_policy" "all_viewer" {
   name = "Managed-AllViewerExceptHostHeader"
 }
 
+# trivy:ignore:AVD-AWS-0011 - WAF is omitted by default to prevent unexpected monthly costs for users
 resource "aws_cloudfront_distribution" "cdn" {
   enabled             = true
   is_ipv6_enabled     = true

package/templates/terraform/main.tf

@@ -17,8 +17,13 @@ resource "aws_cloudwatch_log_group" "app_logs" {
 # --- ECR Repository ---
 resource "aws_ecr_repository" "app" {
   name                 = "{{PROJECT_NAME}}-repo"
+  # trivy:ignore:AVD-AWS-0031 - Mutable tags allow the CI/CD pipeline to reuse the 'latest' tag for simplified deployments
   image_tag_mutability = "MUTABLE"
   force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
 }
 
 # --- IAM: Execution Role ---
@@ -100,11 +105,13 @@ resource "aws_ecs_task_definition" "app" {
 }
 
 # --- Application Load Balancer ---
+# trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
 resource "aws_lb" "main" {
   name               = "{{PROJECT_NAME}}-alb"
   load_balancer_type = "application"
   security_groups    = [aws_security_group.alb.id]
   subnets            = aws_subnet.public[*].id
+  drop_invalid_header_fields = true
 }
 
 resource "aws_lb_target_group" "app" {
@@ -124,6 +131,7 @@ resource "aws_lb_target_group" "app" {
   }
 }
 
+# trivy:ignore:AVD-AWS-0054 - CloudFront handles HTTPS edge termination; ALB uses HTTP to avoid complex ACM DNS validation for users
 resource "aws_lb_listener" "http" {
   load_balancer_arn = aws_lb.main.arn
   port              = "80"

package/templates/terraform/network.tf

@@ -19,6 +19,7 @@ resource "aws_internet_gateway" "main" {
 }
 
 # Create 2 Public Subnets
+# trivy:ignore:AVD-AWS-0164 - Public subnets are used to avoid the $30/mo cost of a NAT Gateway for outbound container traffic
 resource "aws_subnet" "public" {
   count                   = 2
   vpc_id                  = aws_vpc.main.id
@@ -64,6 +65,7 @@ resource "aws_security_group" "alb" {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow ALB to route out to standard AWS services
     cidr_blocks = ["0.0.0.0/0"]
   }
 }
@@ -85,6 +87,7 @@ resource "aws_security_group" "ecs_tasks" {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow containers to pull images and hit external APIs
     cidr_blocks = ["0.0.0.0/0"]
   }
 }