Delivery and software supply chain

A secure deployment proves what code became what image, who approved it, and what is running now.

The path

1. Developer changes reviewed source.
2. CI runs tests, dependency checks, and policy checks.
3. A controlled builder creates the image.
4. The image is scanned and stored in ECR.
5. The release references an immutable digest and provenance.
6. Admission policy accepts only approved artifacts and workload settings.
7. Progressive delivery sends limited traffic first.
8. SLO evidence decides promotion or rollback.

Use short-lived CI federation such as OIDC instead of repository access keys. Separate build, deploy, and approval permissions. Protect production branches and environments.

Rollouts

Set maxUnavailable and maxSurge from actual capacity. Readiness must reflect the user path. Canary or blue/green releases reduce blast radius only when metrics and rollback are reliable.

Database changes

Use expand-and-contract migrations: add compatible schema, deploy code that works with both versions, migrate data, then remove the old schema later.

Feynman check

An image tag is a label that can move. A digest is the parcel's fingerprint. For rollback and forensics, deploy the fingerprint.