I have a CD pipeline built in Jenkins that builds a Java project, packages the microservices as docker containers and uses terraform for provisioning on AWS. What are the plugins I should add to:
- Do a static check of the containers for security flaws
- Do dynamic checks of the webservices for security flaws
- Do any other security checks that might be relevant
I already have Sonarqube set up for static code checking and I am aware of DefectDojo for keeping track of things. I also know of some OWASP tools, but trying to tie it all together in a best practice fashion.