Trust teams but verify: compliance as code done right
summary
Explains how to turn policies into executable controls, for example requiring AWS S3 KMS encryption and verifying it with Chef InSpec wired into CI/CD so checks run locally, in pipeline and in production. Distinguishes preventative and detective controls, recommends iterative rule tuning to avoid slow pipelines, using multiple tools when needed, and aggregating results into alerts and dashboards. Warns against brittle source-coupled rules, black‑box automation, tool-driven workarounds and sporadic (quarterly) execution.
AI-written summary · about
chapters (14)
- 0:00Intro
- 8:20Compliance as code
- 13:12Steps to follow
- 14:19Policy defined
- 14:47Initial steps
- 17:14Academias cooperation policy
- 17:34What are controls
- 22:29Choosing the right tool
- 26:15Writing rules
- 28:22Improving implementation
- 29:52Pipeline run
- 30:22Results
- 31:33Handling results
- 34:39Compliance is code done wrong
related talks
48mTrust Teams but Verify: Compliance as Code Done Right
33mCompliance as Code - Lessons Learned From Regulated Organizations
49mBaking Safety into Infrastructure Testing
31mShifting Left Securely
17mEnhancing cloud security with continuous compliance
33mTest Driven DevOps
31mWrangling Compliance in the Wild West of Software Delivery
38mKick Starting our DevOps Transition with Chef Compliance