Security Testing:
Integrate into your pipelines
If you produce AMs, containers, then scan them with tools like Inspector, Clair, Twistlock, etc.
If tool has an api, you can use a custom lambda action in CodePipeline to trigger it
If a security test fails, Pipeline stops.