Skip to content

devsecops_quickstart.md

Latest commit

 

History

History
118 lines (86 loc) · 2.65 KB

devsecops_quickstart.md

File metadata and controls

118 lines (86 loc) · 2.65 KB
Raw

Quick Start: DevSecOps for IaC

🚀 5-Minute Quick Start

For Beginners

Step 1: Install ThothCTL

pip install thothctl

Step 2: Guided Onboarding

thothctl quickstart

The quickstart command interactively walks you through environment detection, space creation, project initialization, and your first security scan — all in one guided flow.

Step 3: View Results

# Launch the dashboard
thothctl dashboard launch

🎉 Congratulations! You've completed your first DevSecOps workflow!

Already have a project? You can skip quickstart and jump straight to scanning:

cd my-existing-infra
thothctl scan iac -t checkov

🎯 Common Use Cases

Use Case 1: Security Audit

# Run multiple security scanners
thothctl scan iac -t checkov -t trivy

# View consolidated results
thothctl dashboard launch

Use Case 2: Cost Estimation

# Create Terraform plan
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json

# Analyze costs
thothctl check iac -type cost-analysis --plan-file tfplan.json

Use Case 3: Change Impact Analysis

# Assess blast radius
thothctl check iac -type blast-radius --plan-file tfplan.json

Use Case 4: Dependency Management

# Create inventory and check for updates
thothctl inventory iac --check-versions

⚡ One-Command Pipeline

Once you're familiar with the basics, use the workflow command to run entire SDLC phases:

# Quick security audit
thothctl workflow devsecops --phase secure

# Full DevSecOps pipeline
thothctl workflow devsecops --phase all

# Pre-deployment gate (blocks on violations)
thothctl workflow devsecops --phase pre-deploy --enforcement hard

For the complete phase reference, see the Workflow Command Documentation.

📚 Learning Path

Level 1: Beginner (Week 1)

  • Install ThothCTL
  • Initialize first project
  • Run basic security scan
  • Generate documentation

Level 2: Intermediate (Week 2-3)

  • Set up CI/CD integration
  • Use all security scanners
  • Perform cost analysis
  • Create infrastructure inventory

Level 3: Advanced (Week 4+)

  • Implement blast radius assessment
  • Set up compliance policies
  • Automate full DevSecOps pipeline
  • Customize templates and workflows

🔗 Related Resources