Automating FedRAMP Security Compliance with Terraform
summary
Shows how Terraform modules map actual FedRAMP controls into reusable code, targeting FedRAMP Moderate (about 325 controls) while noting cloud providers inherit ~99 controls and Terraform covers roughly 75–85% of the remaining work. Demonstrates concrete resources: S3 bucket policies, versioning, logging, server‑side encryption, lifecycle and replication; VPC endpoints and EC2 security groups; IAM roles; a main.tf + module structure used as both deployment and evidence for an ATO. Mentions FedRAMP‑UP for docs and Terraform Enterprise/Sentinel for enforcement.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 2:52What is FedRAMP compliance
- 7:07Challenges with compliance
- 11:19Scoping FedRAMP controls
- 14:26Prioritizing security controls
- 16:33Mapping controls to Terraform
- 17:59Using Terraform modules
- 20:44Demo of Terraform code
- 23:04S3 module walkthrough
- 25:10Summary and key takeaways
related talks
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
50mFrom Code to Compliance: Enforcing Azure Security with Terraform and...
45mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
45mStreamlining Compliance: Leveraging OS Terraform AWS modules
28mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
31mTerraform Structure & Enablement
29mInfinity and beyond: Scaling Terraform for the global enterprise
29mCompliance At Scale: Hardened Terraform Modules at Morgan Stanley