Shift-Left Compliance
summary
Shift-Left Compliance makes regulatory requirements an intrinsic system property by turning rules into machine-readable policies and enforcing them in CI/CD. It uses Compliance-as-Code with OPA to block Terraform without mandatory tags, enforce FedRAMP customer‑managed keys, and apply a region map for data residency. Integration into GitHub Actions runs checks at PR time, with pre-provisioning validation and audit‑only rollout modes. The platform eliminates a reported reduced two-week retrofit per microservice, saving work across thousands of services in six products.
AI-written summary · about
chapters (12)
- 0:00Shift-Left Compliance intro
- 1:23Compliance challenges
- 4:09Traditional compliance flaws
- 7:16Shift-Left framework
- 9:21Compliance as code
- 14:56Infrastructure compliance
- 19:53Continuous enforcement
- 22:38CI/CD compliance checks
- 26:10Outcomes and benefits
- 28:20Challenges of approach
- 29:23AI in compliance automation
- 30:47Summary
related talks
32mCompliance As Code: Shift-Left and Shift-Right Approaches in a Cloud World
33mCompliance as Code - Lessons Learned From Regulated Organizations
05mCompliance in the Driver’s Seat Is Your Cloud Car Stuck in the Carpark
24mGeneralizing Policy-as-Code for Compliance Posture Management on Multi-Cloud Infrastructure
46mShift-left! Scanning for Security Compliance from Day Zero
45mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
54mCompliance-As-Code For API Security
43mRegulatory Compliance as a DevOps Enabler