Compliance As Code: Shift-Left and Shift-Right Approaches in a Cloud World
summary
The talk argues for using compliance-as-code both shift-left (during template/plan validation) and shift-right (at runtime) in cloud environments, outlining trade-offs: early checks catch many errors but only in specific templates, while runtime checks catch misconfigurations but require provider hooks and larger fixes. It demonstrates tools and workflows including OPA/Rego as a validation service, CloudFormation Guard, and Terraform pipelines that convert plans to JSON, with example policies that enforce S3 encryption and versioning, score results, and publish to AWS Config or auto-remediate by enabling versioning/encryption.
AI-written summary · about
chapters (8)
- 0:00Security agility balance
- 3:31Compliance as Code
- 8:49OPA and CloudFormation Guard
- 13:05BDD for compliance
- 18:36Automate compliance pipelines
- 22:52Shift-Left vs Shift-Right
- 27:05Cloud controls
- 30:16Compliance future
related talks
32mShift-Left Compliance
33mCompliance as Code - Lessons Learned From Regulated Organizations
46mShift-left! Scanning for Security Compliance from Day Zero
05mCompliance in the Driver’s Seat Is Your Cloud Car Stuck in the Carpark
39mAddressing Cloud Security with OPA
24mGeneralizing Policy-as-Code for Compliance Posture Management on Multi-Cloud Infrastructure
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
45mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules