Compliance as Code - Lessons Learned From Regulated Organizations
summary
Argues that treating regulatory controls as executable specs lets teams push changes daily by automating audits and gating deployments; implements a pipeline that runs AWS Config + Lambda to aggregate rules, uses IAM auditor roles and dashboards, and applies Terraform + Inspect profiles and a Packer-based image pipeline. Runs across about 72 markets and 2,000 applications with roughly 250 controls, turning annual evidence hunts into continuous verification and multi‑cloud enforcement.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:52What Is the Feedback Loop
- 5:22What Is the Governance Manual
- 5:37Country Compliance
- 6:39Compliance Is Code
- 16:27Code Testing History
- 20:27Terraform
- 22:17Lessons Learned
- 22:52Centralized Information for Audit
- 26:21Inspect Provisioner
- 29:10Why Do You Want To Automate
related talks
54mCompliance-As-Code For API Security
39mTrust teams but verify: compliance as code done right
43mRegulatory Compliance as a DevOps Enabler
56mCloud compliance journey: Compliance and audits
58mImplementing compliance, assurance, and auditing on
30mProve it! The Last Mile for DevOps in Regulated Organizations
37mCompliance & Regulatory Standards Are NOT Incompatible with Modern Development..
33mCompliance Without the Chaos: Building It Right Into Your DevOps...