流水线结构
源镜像
Amazon Linux 2023
Ubuntu 22.04 LTS
Windows Server 2022
构建组件
CIS 加固脚本
CloudWatch Agent
SSM Agent
Fluent Bit
应用运行时
测试组件
端口暴露检查
服务自启验证
Inspector 漏洞扫描
基线合规检查
分发
多区域复制
跨账号共享
版本标签
SSM Parameter 发布
任一测试组件失败，镜像不进入分发阶段，同时向企业微信/钉钉推送失败详情。
这套流水线解决什么问题
- 补丁不再靠人工登机器，每月自动出新版镜像，滚动替换实例即可完成更新
- 安全基线可审计：每个版本对应一份加固清单和扫描报告，等保与 ISO 审计直接取证
- 启动时间从 3-5 分钟降到 40-70 秒，因为依赖都已经预装在镜像里
- 环境一致性：开发、预生产、生产共用同一镜像血统，杜绝「我本地是好的」
- 回滚简单：SSM Parameter 里存着上一版 AMI ID，改回去重新滚动即可
镜像配方片段
name: cis-baseline-hardening
description: 应用 CIS Level 1 基线并安装可观测性组件
schemaVersion: 1.0
phases:
- name: build
steps:
- name: UpdateOS
action: ExecuteBash
inputs:
commands:
- dnf -y update --security
- name: DisableUnusedServices
action: ExecuteBash
inputs:
commands:
- systemctl disable --now rpcbind 2>/dev/null || true
- systemctl disable --now avahi-daemon 2>/dev/null || true
- name: SshHardening
action: ExecuteBash
inputs:
commands:
- sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
- sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
- sshd -t
- name: InstallAgents
action: ExecuteBash
inputs:
commands:
- dnf -y install amazon-cloudwatch-agent
- rpm -Uvh https://s3.amazonaws.com/amazon-ssm-region/latest/linux_amd64/amazon-ssm-agent.rpm || true
- name: validate
steps:
- name: VerifySshConfig
action: ExecuteBash
inputs:
commands:
- grep -q '^PermitRootLogin no' /etc/ssh/sshd_config
- grep -q '^PasswordAuthentication no' /etc/ssh/sshd_config
- name: VerifyAgents
action: ExecuteBash
inputs:
commands:
- systemctl is-enabled amazon-ssm-agent