Compliance At Scale: Hardened Terraform Modules at Morgan Stanley
summary
Morgan Stanley enforces cloud controls by shipping hardened Terraform modules plus pipeline checks: modules live in a private module registry, resources like SQS enforce KMS encryption by default and derive org IDs and regions from CSP data sources, and the pipeline uses Sentinel rules to block direct resource creation and local modules. Module changes follow semantic versioning where major/minor updates trigger security review, letting app teams deploy safely without ad hoc policy coding.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:16Use Case
- 1:05Security Controls
- 1:40Cloud Security Controls
- 2:59Meeting Controls
- 4:32Security
- 5:50Architecture
- 9:10What goes where
- 9:54Who owns which
- 11:11Fixtures
- 12:58Log Analytics
- 13:20Core Values
- 14:11Standardized Compliance
- 16:13Terraform Modules
- 18:49Amazon SQS
- 21:31Variables
- 23:33Policy
- 26:21Breaking Changes
- 27:31Itaes Challenge
related talks
22mDeploying Terraform Enterprise in a Highly Secure Environment at Morgan Stanley
28mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
35mPackaging Security in Terraform Modules
05mUsing Terraform Safely
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
32mGotchas Using Terraform in a Secure Delivery Pipeline
31mLet Devs Be Devs: Abstracting Compliance + Reliability to Accelerate JPMCs Cloud Deployments
01h 00mGotchas using Terraform in a secure delivery pipeline