In this workshop, you learn how to build compliance into your CI/CD pipeline. Take a list of real-world HIPAA and PCI requirements, and build a continuous deployment pipeline that ensures compliance and best-practices architecture using AWS services such as AWS CodeStar, AWS Config, Amazon Inspector, AWS X-Ray, AWS Lambda, Amazon S3, AWS Glue, and more. You also have the opportunity to write custom AWS Config rules and ensure that your application is proactively compliant in your builds.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Continuous Compliance for
Modern Application Pipelines
Aaron Richmond
Partner Solution Architect
Amazon Web Services
G P S W S 4 0 2

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Module 1: What is continuous compliance?
Module 2: AWS compliance-enabling services
Module 3: Modern application pipelines
Module 4: Policy into technical requirements
Module 5: Comply or FRY!

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
STORY
Intro

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Setup
Launch stacks
bit.ly/2EX0g0r

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 1
Applications

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is continuous compliance?

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 1: What is continuous compliance?
What is compliance?
Why does it matter?
How do I “get” it?

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 1: What is continuous compliance?
DevOps
Build Package DeployCI/CD

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 1: What is continuous compliance?
DevSecOps
Build Package Deploy
Controls Controls
CI/CD

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 1: What is continuous compliance?
DevSecOps
Build Package Deploy
Controls Controls
with Compliance
CI/CD
Continuous
Compliance
benchmarked

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS compliance-enabling services

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Identity and access management
• Logging and monitoring
• Data protection
• Infrastructure security
• Incident response
Achieving compliance around the world with the
AWS Cloud Adoption Framework core five epics
Module 2: AWS compliance-enabling services
• AWS Identity and Access Management (IAM),
AWS Organizations, Amazon Cognito …
• AWS CloudTrail, Amazon CloudWatch,
Amazon GuardDuty …
• KMS, Encryption, ACM, Amazon Macie …
• Amazon VPC, PrivateLink, Amazon CloudFront,
AWS Shield …
• Amazon SNS, Lambda, AWS Shield Advanced …

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 2: AWS compliance-enabling services
Set your controls
AWS Identity and
Access Management
(IAM)
Policies
SCPs
Amazon
CloudWatch
Amazon Virtual
Private Cloud
(Amazon VPC)
NACLs/SGs
Route tables
PrivateLink
Amazon
CloudWatch
Rules
AWS
Config
RulesInfrastructure
as Code
AWS
Service
Catalog

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 2: AWS compliance-enabling services
Monitor your controls
AWS
CloudFormation
Drift
Detection
Amazon
CloudWatch
Metrics
Events
Amazon
GuardDuty
Network
Findings
AWS
Config
Change
Notification
AWS
CloudTrail
Access
Resource APIs

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 2: AWS compliance-enabling services
Verify your controls
AWS
Config
AWS
Artifact
Services in scope
Lambda
Benchmark

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 2: AWS compliance-enabling services
Build controls into your CI/CD
AWS
CodePipeline
Amazon
Inspector
AWS
Config
Secure artifacts
Amazon
ECR
AMI
AWS
Service
Catalog
AWS
Systems
Manager
AWS
X-Ray

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Modern application pipelines

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Modern applications consist of
Module 3: Modern application pipelines

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Modern application pipelines support
Module 3: Modern application pipelines

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 2
Pipelines

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 3
Continuous compliance

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Policy into technical requirements

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitoring and logging (enforce, monitor, respond…)
Audit Program Requirement ID Description
ISO 27001 A.16.1.2 Information security events shall be reported through appropriate
management channels as quickly as possible.
NIST 800-53 AU-6 (1) The organization employs automated mechanisms to integrate audit
review, analysis, and reporting processes to support organizational
processes for investigation and response to suspicious activities.
SOC 1 and 2 8.1 Monitoring and alarming are configured by Service Owners to
identify and notify operational and management personnel of
incidents when early warning thresholds are crossed on key
operational metrics.
HIPAA 164.308(a)(6)(ii) Identify and respond to suspected or known security incidents;
mitigate, to the extent practicable, harmful effects of security
incidents that are known to the covered entity or business associate;
and document security incidents and their outcomes.
IRAP 0123 The cloud vendor must direct personnel to report cyber security
incidents to an ITSM as soon as possible after the cyber security
incident is discovered.

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Policy
P-1.0 Identify and respond to suspected or known security incidents;
Standards
PR-1.0.2 To configure inputs manually in inputs.conf, create a stanza
using the following template and add it to
$SPLUNK_HOME/etc/apps/Splunk_TA_aws/local/inputs.conf…
Procedures
S-1.0.1 AWS CloudTrail and AWS Config must be turned on for all AWS accounts.
S-1.0.2 Every API call and access record shall be routed into company SIEM.

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Manual to automated policy
Identify
Implement
Enforce
Monitor
Alert
Demonstrate

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Identify specifics
1.1 Avoid the use of the "root" account
1.7 Ensure IAM password policies require at least one symbol
1.24 Ensure IAM policies that allow full "*:*" administrative
privileges are not created
PCI-DSS requirement 8.5
Shared user IDs do not exist for system administration and other critical functions

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Implement
AWS resource configuration
Least privilege
Reduced scope
Automation of controls
Well-architected

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Enforce
Easy Advanced
Pre-built
AWS Config rules
CloudWatch
Alarm on metric or filter
Rule on event
Advanced
AWS Config rules

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Monitor AWS Config
- Configuration change
- Periodically
GuardDuty
- Findings
CloudWatch
- Alarm on metric, filter
- Rule with event, target
CloudTrail
- API calls

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Alert CloudWatch
SNS Topic
Event Targets
AWS Config
SNS Topic
AWS resource notifications
S3 events

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4: Policy into technical requirements
Demonstrate via benchmark

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
And now …

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Comply or FRY!

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Comply or FRY!
Agnes the auditor is coming to audit your startup
If you fail you are going under
The company's future is in your hands

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Continuous compliance for
modern application pipelines
Module 1: What is continuous compliance?
Module 2: AWS compliance-enabling services
Module 3: Modern application pipelines
Module 4: Policy into technical requirements
Module 5: Comply or FRY!

38. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Aaron Richmond
arichmon@amazon.com

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.