EC2 해킹당하고, DevSecOps 파이프라인을 구축하다

1
Subject: Your AWS account may be compromised
2

3
Hello,
4

5
Please review this important message regarding the security of your
6
AWS account and take action as requested.
7

8
We have received one or more reports that the following AWS resources:
9

10
  AWS ID: 44051xxxxx19
11
  Region: ap-northeast-2
12
  EC2 Instance Id: i-0244d4851bxxxxxx
13

14
have been implicated in activity that indicates that it may be
15
infected with malware and may be part of a botnet.
16

17
Please be aware, operating a host that is a part of a malicious
18
network, or "botnet", is forbidden per the AWS Acceptable Use Policy.
19

20
---Beginning of forwarded report(s)---
21

22
Details of the abusive activity:
23
  Report begin time: 2025-12-16 17:14:16 UTC
24
  Report end time: 2025-12-16 17:16:15 UTC
25
  Average Gbits/sec sent: 0.509
26

27
It appears the instance(s) may be compromised and triggered an attack.
28

29
Regards,
30
AWS Trust & Safety

1
flowchart LR
2
    subgraph sg["개발환경 보안 그룹 (문제)"]
3
        pg["PostgreSQL<br>:5432"]
4
        redis["Redis<br>:6379"]
5
        pgadmin["pgAdmin<br>:15432"]
6
    end
7

8
    internet(("인터넷<br>0.0.0.0/0"))
9

10
    internet -->|"❌ 허용"| pg
11
    internet -->|"❌ 허용"| redis
12
    internet -->|"❌ 허용"| pgadmin

1
flowchart LR
2
    subgraph sg["개발환경 보안 그룹 (수정)"]
3
        pg["PostgreSQL<br>:5432"]
4
        redis["Redis<br>:6379"]
5
        pgadmin["pgAdmin<br>:15432"]
6
    end
7

8
    vpc(("VPC 내부<br>10.0.0.0/16"))
9

10
    vpc -->|"✅ 내부만 허용"| pg
11
    vpc -->|"✅ 내부만 허용"| redis
12
    vpc -->|"✅ 내부만 허용"| pgadmin

1
flowchart TB
2
    subgraph pipeline["CI/CD Pipeline"]
3
        direction TB
4
        subgraph scanners["보안 스캐너"]
5
            trivy["Trivy<br>(SCA)"]
6
            sonarqube["SonarQube<br>(SAST)"]
7
        end
8
        defectdojo["DefectDojo<br>(통합 관리)"]
9
        discord["Discord 알림"]
10

11
        trivy --> defectdojo
12
        sonarqube --> defectdojo
13
        defectdojo --> discord
14
    end

1
name: CI/CD Pipeline
2

3
on:
4
  pull_request:
5
    branches: [main, develop]
6
  push:
7
    branches: [main]
8
    tags: ["v*.*.*"]
9

10
env:
11
  TRIVY_CRITICAL_THRESHOLD: 2
12
  TRIVY_HIGH_THRESHOLD: 25
13
  BLOCK_ON_FAILURE: false
14

15
jobs:
16
  trivy-scan:
17
    name: Trivy Scan
18
    runs-on: ubuntu-latest
19
    outputs:
20
      critical_count: ${{ steps.parse.outputs.critical_count }}
21
      high_count: ${{ steps.parse.outputs.high_count }}
22
      summary: ${{ steps.parse.outputs.summary }}
23

24
    steps:
25
      - uses: actions/checkout@v4
26

27
      - name: Run Trivy
28
        uses: aquasecurity/trivy-action@master
29
        with:
30
          scan-type: "fs"
31
          scan-ref: "."
32
          trivy-config: .github/config/trivy.yaml
33
          format: "json"
34
          output: "trivy-results.json"
35
        env:
36
          TRIVY_SERVER: ${{ secrets.TRIVY_SERVER_URL }}
37
          TRIVY_TOKEN: ${{ secrets.TRIVY_TOKEN }}
38
        continue-on-error: true
39

40
      - name: Parse Results
41
        id: parse
42
        run: |
43
          CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' trivy-results.json)
44
          HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH")] | length' trivy-results.json)
45
          echo "critical_count=$CRITICAL" >> $GITHUB_OUTPUT
46
          echo "high_count=$HIGH" >> $GITHUB_OUTPUT
47

48
      - name: Check Thresholds
49
        run: |
50
          if [ "$BLOCK_ON_FAILURE" = "true" ] && [ "$CRITICAL_COUNT" -gt "$TRIVY_CRITICAL_THRESHOLD" ]; then
51
            echo "CRITICAL threshold exceeded"
52
            exit 1
53
          fi
54

55
      - name: Upload to DefectDojo
56
        if: always()
57
        run: |
58
          curl -X POST "${DEFECTDOJO_URL}/api/v2/import-scan/" \
59
            -H "Authorization: Token ${DEFECTDOJO_TOKEN}" \
60
            -F "scan_type=Trivy Scan" \
61
            -F "file=@trivy-results.json" \
62
            -F "product_name=SYC Backend" \
63
            -F "engagement_name=CI Security Scan"
64

65
  sonarqube-scan:
66
    name: SonarQube
67
    runs-on: ubuntu-latest
68
    outputs:
69
      quality_gate: ${{ steps.qg.outputs.quality-gate-status }}
70

71
    steps:
72
      - uses: actions/checkout@v4
73
        with:
74
          fetch-depth: 0
75

76
      - name: Set up JDK 21
77
        uses: actions/setup-java@v4
78
        with:
79
          java-version: "21"
80
          distribution: "temurin"
81
          cache: gradle
82

83
      - name: Build with Gradle
84
        run: ./gradlew build -x test
85

86
      - name: SonarQube Scan
87
        uses: sonarsource/sonarqube-scan-action@master
88
        env:
89
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
90
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
91

92
      - name: Quality Gate
93
        id: qg
94
        uses: sonarsource/sonarqube-quality-gate-action@master
95
        continue-on-error: true
96

97
      - name: Upload to DefectDojo
98
        if: always()
99
        run: |
100
          curl -s -u "${SONAR_TOKEN}:" \
101
            "${SONAR_HOST_URL}/api/issues/search?componentKeys=syc-be" \
102
            -o sonar-issues.json
103

104
          curl -X POST "${DEFECTDOJO_URL}/api/v2/import-scan/" \
105
            -H "Authorization: Token ${DEFECTDOJO_TOKEN}" \
106
            -F "scan_type=SonarQube Scan" \
107
            -F "file=@sonar-issues.json" \
108
            -F "product_name=SYC Backend" \
109
            -F "engagement_name=CI Security Scan"
110

111
  # docker-build-api, docker-build-batch, deploy job은 생략
112

113
  notify:
114
    name: Notify
115
    needs:
116
      [trivy-scan, sonarqube-scan, docker-build-api, docker-build-batch, deploy]
117
    if: always()
118

119
    steps:
120
      - name: Discord
121
        env:
122
          CRIT: ${{ needs.trivy-scan.outputs.critical_count }}
123
          HIGH: ${{ needs.trivy-scan.outputs.high_count }}
124
          QG: ${{ needs.sonarqube-scan.outputs.quality_gate }}
125
        run: |
126
          # 성공/실패/취소 분기 처리 후 Discord Embed 전송
127
          curl -H "Content-Type: application/json" -d "{
128
            \"embeds\": [{
129
              \"title\": \"✅ 배포 완료\",
130
              \"fields\": [
131
                {\"name\": \"Trivy\", \"value\": \"Critical: $CRIT, High: $HIGH\"},
132
                {\"name\": \"SonarQube\", \"value\": \"Quality Gate: $QG\"}
133
              ]
134
            }]
135
          }" "$WEBHOOK"

1
심각도: BLOCKER
2
유형: Hardcoded Secret
3
위치: application-local.yml
4
내용: 비밀번호 하드코딩 탐지