Delivering Golden AMIs with Spinnaker
summary
Shows a complete, in-band Spinnaker pipeline that bakes an AMI with Rosco/Packer, tags it golden-ami-candidate, launches one instance with the AWS Inspector agent, and uses Spinnaker webhooks -> API Gateway -> Lambda to invoke AWS Inspector and fetch results. Pipeline waits, surfaces a manual judgment stage to approve or reject, then tags approved AMIs and publishes or deletes denied ones. Uses GitHub sync, SNS for notifications, and can be extended to auto-approve from JSON reports based on vulnerability thresholds.
AI-written summary · about
chapters (13)
- 0:00Introduction to Golden AMIs
- 1:05Why Golden AMIs matter
- 2:52Golden AMI pipeline overview
- 4:16AWS vs Spinnaker pipeline
- 6:01Spinnaker solution architecture
- 7:44Prerequisites setup
- 9:31Pipeline automation details
- 9:53Bake stage explained
- 11:18Tag and deployment stages
- 12:43AWS Inspector integration
- 13:48Assessment and approval process
- 15:37Automation improvements
- 15:57Summary and benefits
related talks
56mHCP Packer Learn Lab: Build a Golden Image Pipeline
14mAMI Creation And IaC Deploys via Semaphore
28mUsing an Image Release Process for Security Wins
11mAutomating AMIs for reliability, security, and cost (PRT074)
48mContinuous Delivery with Spinnaker
22mLeveraging Chef, Packer, and Habitat for Effortless AMI Deployments
23mBuilding a Secure AWS Golden Image Pipeline with Packer, Vault and Terraform
08mAutomated & Immutable Spinnaker Deployments with Security...