Security & Compliance in Production
Compliance as an exhaust pipe
Make security a property of the pipeline, not a gate held later: least-privilege by default, secrets and image scanning in CI, runtime guardrails, and continuous compliance evidence instead of a pre-audit scramble.
What you will learn
- Embed security checks into the pipeline, not next to it
- Enforce least privilege at the platform layer
- Produce continuous compliance evidence
In production, security is a pipeline property: image scans + secret detection in CI, deployed images signature-verified, IAM least privilege with deny-by-default guardrails, runtime monitoring (threat detection, drift) and policy-as-code that continuously scores and reports against the compliance set — so the audit reads logs, not last-minute scramble.
What is this?
Shift-left: CI runs SAST, dependency/image CVE scans, secret scanning, license checks; policy-as-code (OPA/Cloud Custodian/Azure Policy/IAM conditions) blocks non-compliant IaC before it lands. Secret hygiene: vaults (KMS/Secret Manager) not env files; short-lived creds where possible; incident response for leaked secrets (rotation, not just deletion). Runtime: image signing + verification at deploy, least-privilege roles + deny-by-default network policy, and anomaly/cloud-detection feeds. Compliance evidence: continuous collection of logs, config snapshots, access reviews; CIS/NIST/ISO mapping that is scored by policy and reported automatically; evidence retention aligned to the standard. Drift: any out-of-band change appears in config reports within minutes. The mindset: treat compliance like a metric — continuously green, with the report generated, not an office decorated for inspection day.
Why do you need it?
- Shifting left catches flaws when they cost minutes to fix, not incidents later.
- Least-privilege + guardrails shrink the blast radius of every credential leak.
- Continuous evidence removes the pre-audit crunch and the surprise findings.
- Policy-as-code makes compliance reviews and amplifies genuinely reviewable.
Mental model
Security theater performed on audit day
An engine's continuous emissions meter
Compliance is continuous evidence, not a decoration for inspection day.
How it works
- CI gates on SAST/CVE/secret scans before merge and deploy.
- Deploy pulls only signed images, roles scoped to the service.
- Policy-as-code evaluates IaC + runtime against the standard continuously.
- Logs + config snapshots feed the compliance report; breaches alert on-call.
Security as a pipeline property.
In production
- A public service that blocks PRs with a critical CVE and enforces signed images in prod.
- SCP/deny rules that forbid public egress to the internet from the payments subnet.
- A weekly automated CIS score report with a Slack channel, instead of a PDF before the audit.
Best practices
- Deny by default; allow only what the service needs.
- Scan images from the pipeline, and verify signatures at deploy.
- Rotate secrets continuously; treat a leaked secret as an incident.
- Compliance is a continuously-observed, automatically-reported metric.
Common mistakes
- Security as a manual QA step at the end — it becomes the thing skipped in a rush.
- A permissive role 'to keep things working' — it becomes the thing the attacker takes.
- Evidence collected only during audit season.
Debugging tips
- Compliance finding on a new service → diff its IaC against the guardrail exception list first.
- Secret flagged in git → assume exposure, rotate immediately, then scrub history — rotation before deletion.
Interview checkpoint
Hands-on lab
- Lay out the CI security gates (scan, SAST, secret)
- Add a deny-by-default guardrail definition
- Sketch the continuous compliance evidence flow
Embed Security Gates in a Pipeline
30 min · advanced
Quick quiz
A secret leaks in a commit. First action?