I have a CD pipeline built in Jenkins that builds a Java project, packages the microservices as docker containers and uses terraform for provisioning on AWS. What are the plugins I should add to:

  1. Do a static check of the containers for security flaws
  2. Do dynamic checks of the webservices for security flaws
  3. Do any other security checks that might be relevant

I already have Sonarqube set up for static code checking and I am aware of DefectDojo for keeping track of things. I also know of some OWASP tools, but trying to tie it all together in a best practice fashion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.