Cloud Security
Intermediate 14 min read Cloud Security

Compliance & Governance

Live up to the contracts, on paper and in code

Compliance frameworks (SOC2, ISO 27001, HIPAA, FedRAMP) are contracts; cloud governance is the machinery that proves you keep them — inventory, policies, drift detection, and evidence automation.

SOC2ISO 27001HIPAAgarpNISTconfigpolicyCompliance
Prerequisites: Security Basics & Core Services
Before we start

What you will learn

  • Map frameworks to cloud policy/audit workloads
  • Operate compliance scanning + evidence pipelines
  • Design guardrails that prevent vs detect violations
In 60 seconds

Governance = policies (what's allowed), inventory (what exists), detection (drift/Config), prevention (SCPs/Policy guardrails), and evidence (scanned results exported for auditors). Compliance frameworks basically check that machinery runs.

Introduction

What is this?

Frameworks: SOC 2 (Type II), ISO 27001/27002, PCI DSS, HIPAA, FedRAMP, CIS Benchmarks, NIST 800-53/CIS v8 — each maps to 'controls' with evidence. Tooling: AWS Config (rules + aggregated), Control Tower + SCPs (guardrails), Azure Policy + Policy-as-code + Defender posture, GCP Organization Policy + Asset Inventory + Forseti-ish; plus CasC (Checkov/Kics) at IaC time. Evidence & artifacts: compliance scanning exports, retention of logs, backups, pen-test reports, inventory snapshots. Prevention pattern: SCP/org policy deny (e.g. delete-protection, deny public bucket) beats detection. Continuous vs periodic: daily scan + alert, quarterly evidence pack.

Motivation

Why do you need it?

  • Compliance is customer-negotiable; evidence is not nullable.
  • Preventive guardrails at the org boundary stop 'someday-later' mistakes before they're violations.
  • Automated evidence generation replaces scared sprint-week screenshots with an audit TLS chain.
  • Governance cuts incidents: the same policy that satisfies auditors prevents real-world misconfig.
Think about it

Mental model

Imagine

Health inspections: a checklist + a system that prevents a dirty kitchen before inspection

Think of

Governance/Compliance automation

The inspector wants evidence the kitchen stays clean daily (evidence automation), not one lucky photo. The real system prevents violations (guardrails) so the checklist is always true.

Mechanics

How it works

  • Org policy (SCP/Policy) denies disallowed states at the boundary.
  • Config/Policy continuously evaluate resources vs rules (non-compliant list).
  • Auto-remediate non-compliant events where safe (stop/delete public-resource).
  • Scanning exports + logs assembled into an evidence pack per framework.
  • Auditors review evidence + continual monitoring; gaps become work items.

Governance loop.

Guardrails
Scan
Non-compliant
Evidence
Audit
Hands-on

Examples

A guardrail-ish Config rule (structure)

A guardrail-ish Config rule (structure)
resource "aws_config_config_rule" "no_public_sg" {
  name = "no-public-sg"
  source {
    owner            = "AWS"
    source_identifier = "INCOMING_PUBLIC_IP_SGS_CLOSED"
  }
  // remediation (event → lambda) closes the SG or pages on-watch.
}
# org SCP equivalently denies CreateSecurityGroup with 0.0.0.0/0

Prevention (SCP deny) + detection (Config rule) + remediation closes the loop before an auditor sees a violation.

Real world

In production

  • Control Tower guardrails + Config rules across all accounts; alert on non-compliant CSS.
  • PCI: monthly evidence pack = scans + access reviews + logs, generated by a pipeline.
  • CIS Benchmark scanning via cloud-native posture + CasC policy in IaC PRs.
Guidelines

Best practices

  • Prefer org-level guardrails (deny) over detection-only for risky operations.
  • Map every Config/Policy rule to a compliance control id so evidence is trail-traceable.
  • Automate evidence: generate the pack on a schedule from scans + logs — no hand-screenshots.
  • Keep inventory current: every resource tagged; untagged = suspect cluster.
  • Audit your own compliance post: quarterly self-review the automation, not just output.
Watch out

Common mistakes

  • Config enabled but no rules → 'we run Config' yet zero violations tracked.
  • Evidence packs built at audit time from memory (fatal for a real auditor).
  • Guardrails deny everything → developer friction becomes shadow-IT cloud accounts.
  • Treating one framework pass as 'compliant' while other controls still float.
When things break

Debugging tips

  • Rule shows 'N/A' forever → find the rule's scope/resource types; the resource may not be evaluated for that rule type.
  • Remediation failing → event trigger/principal perms on the remediation lambda.
  • Auditor pushes back on evidence → export with resource tags + control linkage, not raw JSON dumps.
  • Policy drift between environments → promote rule sets as IaC, diff in PRs.
Interviews

Interview checkpoint

Practice

Hands-on lab

Scan Compliance and Reconcile Drift
40 min · intermediate
In progress
Objectives
  • Enable a posture scanner + a foundational rule
  • Create a deliberate violation and watch it flagged
  • Auto-remediate or document the exception

Scan Compliance and Reconcile Drift

40 min · intermediate

0/4 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

A guardrail SCP is:

2

Evidence automation means:

Go deeper

Official documentation

AWS Config
docs
Azure Policy
docs
GCP Org constraints
docs