End-to-end policy-as-code from IaC to Running Workloads
summary
Claim: the same policies run from developer laptop to production and actually catch issues. Uses chekov CLI (open source) to scan Terraform, Kubernetes, Helm, CloudFormation — tested against terraform-goat and kubernetes-goat and finds real failures (example: a wildcard ClusterRole in a pawn chart). Provides a VS Code plugin, pre-commit hooks, GitHub/GitLab annotation via an API key, and a Bridgecrew platform that runtime cluster scanning receives manifests and flags drift — end-to-end scans and PR annotations work.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:18What is endtoend policyascode
- 1:29Using chekhov
- 5:04Using Bridgecrew
- 8:29Integrations
- 10:45Checkoff
related talks
25mPolicy as [versioned] Code
43mPolicy-as-code for Any Cloud to Any Edge Automation
20mTrust but Verify
11mRealizing DevSecOps with GitLab and Infrastructure as Code
22mSecurity vs Dev Experience Threat … or Opportunity
01h 00mSecurely deploying Infrastructure as Code
26mEverything You Should Be Doing, But Aren’t: DevSecOps for K8s Workflows
32mCloud Native Policy as Code: Principles and Best Practices