stackconf 2024 | Streamlining Compliance Leveraging Open-Source Terraform AWS modules by Anton Babenko.pdf

Are you navigating the complexities of compliance frameworks like SOC2, CIS, and HIPAA and seeking a more efficient path? This talk breaks down these frameworks simply and shows you a time-saving trick, making it perfect for anyone wanting to make their organization’s compliance journey much easier. I’ll start by outlining the basics of these frameworks and highlighting the challenges businesses face in implementing them. As the creator and maintainer of the terraform-aws-modules projects, I’ll be excited to share how using these open-source Terraform AWS modules can streamline the compliance process. I’ll walk you through real-life examples showing how such solutions significantly reduce the effort and time required for compliance. At the end of the talk, attendees will get actionable insights on using Terraform AWS modules for efficient compliance management.

1. –Степан Яблучко
“Введіть цитату тут.”
!
Streamlining Compliance: Leveraging Open-Source Terraform
AWS modules
Anton Babenko
June 2024

2. Anton Babenko
AWS Community Hero / Terraform influencer since 2015.
Organiser of user groups in Oslo — HashiCorp, AWS, DevOps.
I " open-source:
terraform-aws-modules
antonbabenko/pre-commit-terraform — clean code, documentation, and more
antonbabenko/terraform-aws-devops — Terraform, AWS, and DevOps projects
serverless.tf — Doing serverless on AWS with Terraform
www.terraform-best-practices.com
bit.ly/terraform-youtube — Your weekly dose of Terraform (news, reviews, Q&A, interviews, and live coding)
weekly.tf — Terraform Weekly newsletter
@antonbabenko — Twitter, GitHub, Linkedin
!

3. http://bit.ly/
terraform-
youtube
!

4. @antonbabenko !
weekly.tf

5. Collection of 50+ open-source Terraform AWS modules supported by the community with over 500
million provisions
VPC, EKS, RDS, IAM, Lambda, and many more…
github.com/terraform-aws-modules
registry.terraform.io/modules/terraform-aws-modules
@antonbabenko !

6. @antonbabenko !

7. Agenda
What is compliance?
Walkthrough a compliance process
Demo: Implementing required compliance controls
@antonbabenko !

8. Compliance
Proof that clients can trust your company with their data
Compliance is a Shared Responsibility
@antonbabenko !

9. Compliance is a Shared Responsibility
@antonbabenko !
https://aws.amazon.com/compliance/shared-responsibility-model/

10. Compliance Frameworks
A set of structured guidelines that helps organisations satisfy regulatory
requirements, industry standards, and internal policies.
Focus on managing risk and improving security.
Involves the implementation of security controls, continuous monitoring,
and detailed documentation to meet legal and regulatory obligations.
Vary by industry and data type, risk management, operational efficiency.
Which one to choose?
@antonbabenko !

11. Types of Compliance Frameworks
CIS: The Center for Internet Security (CIS) Controls are a set of
actionable guidelines and best practices designed to help
organizations protect themselves against prevalent cyber threats.
SOC 2 (Service Organization Control): Security, availability, processing
integrity, confidentiality, and privacy. Standard for service providers
storing customer data.
GDPR: Personal data of individuals within the EU.
PCI DSS: A set of standards to ensure a secure environment to accept,
process, store, or transmit credit card information.
@antonbabenko !

12. Compliance Process
Understand the shared responsibility model
Identify applicable regulations and standards
Assess current compliance posture (AWS Security Hub, Prowler,
Steampipe, CloudQuery)
Implement required controls (Terraform)
Automate compliance processes (e.g. auto-remediation)
Conduct regular audits
@antonbabenko !

13. How to implement required controls?
checkov, trivy, kics, terrascan
Review Terraform configurations, run scans, understand scan results
and remediation steps
Apply remediations steps
… or use compliance-ready Terraform configurations by
compliance.tf
@antonbabenko !

14. @antonbabenko !

15. Demo
@antonbabenko !

16. !
Q3

17. Thank you!
Questions?
Subscribe to "Your Weekly Dose of Terraform" — http://bit.ly/terraform-youtube
github.com/antonbabenko
twitter.com/antonbabenko
!