Compliance in the Driver’s Seat Is Your Cloud Car Stuck in the Carpark
summary
A banking client cannot deploy because security deems the cloud design noncompliant, so the team automates pipelines, enforces cloud policies, adds alerting and captures terraform config as evidence, then struggles to feed drift back into the GRC JIRA workflow. The result is an open source project called Compliance Framework that provides a dashboard and a plugin model for checks like terraform providers and file checks, aiming for real-time tracking of control status; it is a work in progress.
AI-written summary · about
related talks
33mCompliance as Code - Lessons Learned From Regulated Organizations
54mCompliance-As-Code For API Security
32mShift-Left Compliance
30mTackling the new paradigm of regulatory compliance in the cloud era
32mCompliance As Code: Shift-Left and Shift-Right Approaches in a Cloud World
50mFrom Code to Compliance: Enforcing Azure Security with Terraform and...
28mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
05mCloud-Driven Compliance for Scalable Provider Network Governance