SlideShare a Scribd company logo
1 of 38
Download to read offline
How to Implement an Effective
Cloud Resource Tagging Strategy
Using Infrastructure As Code
A new open source project is born
@BarakSchoster
Our story begins
with
a log
A Slack message
Followed by
More slack messages
Security hub alerts
A solution
Jira tickets
And some Jira follow ups
Problem source
Code
Triage
The process
Pager Alert
Slack
Thread
CloudTrail
Triage
Jira
Assigned
Jira
Reassignment
Code Fix
Deploy to
Prod
MTTR IS
TOO
LONG
There’s got
to be a
better way
Tagging use cases
13 | © 2021 Palo Alto Networks, Inc. All rights reserved.
Automation
Security Risk Management
Operation Support
Console Organization
Cost Allocation
Consolidate resource groups
inventory based on tags
identify resources that require
heightened security Break down cost by tag of cost
center, business unit or project
Opt in and out infrastructure
scaling scripts using tags
Incident management
triage using tags
Access Control
IAM policies conditions
based on tags
Tagging best practices
1. Employ a Cross-Functional Team to Identify Tag Requirements
2. Use Tags Consistently
3. Assign Owners to Define Tag Value Propositions
4. Focus on Required and Conditionally Required Tags
5. Start Small; Less is More
6. Use Automation to Proactively Tag Resources
7. Remediate Untagged Resources
Make it so
What is
?
Open source (Apache 2.0) tagging
framework for IaC, intended to be used
in CI/CD pipelines
1. Automated tagging
2. Built in best practices for tracing
3. Built in best practices for ownership
Installing Yor
What is Yor Trace?
Where did this
resource come from?
How was it
configured?
Where do I fix a
misconfig?
What runtime
resources are
provisioned from this
code?
No need to access state or sensitive
information to answer those questions
What are git tags?
Runtime issue
Build resource traces
Demo Time
Integrating Yor into the GitOps workflow
IaC
commit pull
request
commit
trace tags
merge apply
trace
Tagging is a team play
The ownership culture
You
Build
It
You
Run
It
Dependencies are a joint ownership...
...and Yor can help you manage that.
Recap: What can you do with Yor
Organize cloud inventory
Standardize ownership
Reduce MTTR
Yor in Operations Support
Reduce MTTR by routing issues to the right people
using event rules relaying on tag data
Recap: What can you do with Yor
Organize cloud inventory
Reduce MTTR
Standardize ownership
Enrich policy engines
Integrating Yor and Checkov
Example
Allow only the security team to
edit CloudTrail configurations
Policy as Code Enrichment engine
Checkov policy
Checkov policy
Fail a build if the resource doesn't comply with the policy
Recap: What can you do with Yor
Organize cloud inventory
Reduce MTTR
Standardize ownership
Enrich policy engines
Access control
Using Yor in AWS IAM
Tag/ Label
Everything
Tagging use cases
36 | © 2021 Palo Alto Networks, Inc. All rights reserved.
Automation
Security Risk Management
Operation Support
Console Organization
Cost Allocation
Consolidate resource groups
inventory based on tags
identify resources that require
heightened security Break down cost by tag of cost
center, business unit or project
Opt in and out infrastructure
scaling scripts using tags
Incident management
triage using tags
Access Control
IAM policies conditions
based on tags
The future of Yor
● YAML tagging rules
● Support for k8 manifests
● Drift detection
● Community invite: more extensions for SRE systems
Thank you
@BarakSchoster
https://github.com/bridgecrewio/yor
https://slack.bridgecrew.io/

More Related Content

What's hot

Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...
Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...
Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...
Gravitant, Inc.
 
Anytime a user can’t access that data, there’s a cost
Anytime a user can’t access that data, there’s a costAnytime a user can’t access that data, there’s a cost
Anytime a user can’t access that data, there’s a cost
LabeedAhmadQamar
 
Cw13 aws by tamer abdul radi-cloud9ners
Cw13 aws by tamer abdul radi-cloud9nersCw13 aws by tamer abdul radi-cloud9ners
Cw13 aws by tamer abdul radi-cloud9ners
TheInevitableCloud
 

What's hot (20)

Introduction: AWS-Enabled Enterprise Storage Solutions
Introduction: AWS-Enabled Enterprise Storage SolutionsIntroduction: AWS-Enabled Enterprise Storage Solutions
Introduction: AWS-Enabled Enterprise Storage Solutions
 
Fintech Pace Security on AWS: The Customer Perspective
Fintech Pace Security on AWS: The Customer PerspectiveFintech Pace Security on AWS: The Customer Perspective
Fintech Pace Security on AWS: The Customer Perspective
 
Case-Study: AWS Cloud Cost Optimization with insisive cloud
Case-Study: AWS Cloud Cost Optimization with insisive cloudCase-Study: AWS Cloud Cost Optimization with insisive cloud
Case-Study: AWS Cloud Cost Optimization with insisive cloud
 
Cloud Acquisition Strategies: How to Buy the Cloud
Cloud Acquisition Strategies: How to Buy the CloudCloud Acquisition Strategies: How to Buy the Cloud
Cloud Acquisition Strategies: How to Buy the Cloud
 
Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...
Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...
Gartner IT Symposium 2013: Delivering IT-as-a-Service with Cloud Brokering an...
 
Building an Enterprise-Grade Azure Governance Model
Building an Enterprise-Grade Azure Governance ModelBuilding an Enterprise-Grade Azure Governance Model
Building an Enterprise-Grade Azure Governance Model
 
Culture Eats Strategy for Breakfast
Culture Eats Strategy for BreakfastCulture Eats Strategy for Breakfast
Culture Eats Strategy for Breakfast
 
Aws intro to cloud_economics
Aws intro to cloud_economicsAws intro to cloud_economics
Aws intro to cloud_economics
 
Anytime a user can’t access that data, there’s a cost
Anytime a user can’t access that data, there’s a costAnytime a user can’t access that data, there’s a cost
Anytime a user can’t access that data, there’s a cost
 
Cloud Computing Series - Part II: SmartSheet Case Study
Cloud Computing Series - Part II: SmartSheet Case StudyCloud Computing Series - Part II: SmartSheet Case Study
Cloud Computing Series - Part II: SmartSheet Case Study
 
Optimizing IT Procurement and Deployment for Innovation
Optimizing IT Procurement and Deployment for InnovationOptimizing IT Procurement and Deployment for Innovation
Optimizing IT Procurement and Deployment for Innovation
 
Cloud Innovation with Safety Rails
Cloud Innovation with Safety RailsCloud Innovation with Safety Rails
Cloud Innovation with Safety Rails
 
Search for All with Elastic Workplace Search
Search for All with Elastic Workplace SearchSearch for All with Elastic Workplace Search
Search for All with Elastic Workplace Search
 
Be Proactive, Not Reactive: Cloud Governance for Fast, Accurate Decision Making
Be Proactive, Not Reactive: Cloud Governance for Fast, Accurate Decision MakingBe Proactive, Not Reactive: Cloud Governance for Fast, Accurate Decision Making
Be Proactive, Not Reactive: Cloud Governance for Fast, Accurate Decision Making
 
Cw13 aws by tamer abdul radi-cloud9ners
Cw13 aws by tamer abdul radi-cloud9nersCw13 aws by tamer abdul radi-cloud9ners
Cw13 aws by tamer abdul radi-cloud9ners
 
[Webinar] When It Comes To Cloud, Great Power Brings Great Responsibility
[Webinar] When It Comes To Cloud, Great Power Brings Great Responsibility[Webinar] When It Comes To Cloud, Great Power Brings Great Responsibility
[Webinar] When It Comes To Cloud, Great Power Brings Great Responsibility
 
Search for All with Elastic Workplace Search
Search for All with Elastic Workplace SearchSearch for All with Elastic Workplace Search
Search for All with Elastic Workplace Search
 
Insight to Action Visibility, Optimization & Governance for Your AWS Cloud En...
Insight to Action Visibility, Optimization & Governance for Your AWS Cloud En...Insight to Action Visibility, Optimization & Governance for Your AWS Cloud En...
Insight to Action Visibility, Optimization & Governance for Your AWS Cloud En...
 
Creating an Effective Roadmap for Your Cloud Journey (ENT225-R1) - AWS re:Inv...
Creating an Effective Roadmap for Your Cloud Journey (ENT225-R1) - AWS re:Inv...Creating an Effective Roadmap for Your Cloud Journey (ENT225-R1) - AWS re:Inv...
Creating an Effective Roadmap for Your Cloud Journey (ENT225-R1) - AWS re:Inv...
 
ThreatStack Workshop: Stop Wasting Your Time: Focus on Security Practices tha...
ThreatStack Workshop: Stop Wasting Your Time: Focus on Security Practices tha...ThreatStack Workshop: Stop Wasting Your Time: Focus on Security Practices tha...
ThreatStack Workshop: Stop Wasting Your Time: Focus on Security Practices tha...
 

Similar to Owasp devslop how to implement an effective cloud resource tagging strategy using ia c

Agile Gurugram 2023 I Metrics and Business Agility - Dinker Charak
Agile Gurugram 2023 I Metrics and Business Agility - Dinker CharakAgile Gurugram 2023 I Metrics and Business Agility - Dinker Charak
Agile Gurugram 2023 I Metrics and Business Agility - Dinker Charak
AgileNetwork
 
Agile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker Charak
Agile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker CharakAgile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker Charak
Agile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker Charak
AgileNetwork
 
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_SingaporePractical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
Amazon Web Services
 
Biz Talk Demo slideshare
Biz Talk Demo slideshareBiz Talk Demo slideshare
Biz Talk Demo slideshare
erios
 

Similar to Owasp devslop how to implement an effective cloud resource tagging strategy using ia c (20)

Automated Security & Continuous Compliance on Microsoft Azure
Automated Security & Continuous Compliance on Microsoft AzureAutomated Security & Continuous Compliance on Microsoft Azure
Automated Security & Continuous Compliance on Microsoft Azure
 
Novel cloud computingsecurity issues
Novel cloud computingsecurity issuesNovel cloud computingsecurity issues
Novel cloud computingsecurity issues
 
cloudComputingSec_p3.pptx
cloudComputingSec_p3.pptxcloudComputingSec_p3.pptx
cloudComputingSec_p3.pptx
 
Alfresco Virtual DevCon 2020 - Security First!
Alfresco Virtual DevCon 2020 - Security First!Alfresco Virtual DevCon 2020 - Security First!
Alfresco Virtual DevCon 2020 - Security First!
 
July 31, 2020 - CSA LA event slides
July 31, 2020 - CSA LA event slidesJuly 31, 2020 - CSA LA event slides
July 31, 2020 - CSA LA event slides
 
Operational Excellence for Identity & Access Management (SEC334) - AWS re:Inv...
Operational Excellence for Identity & Access Management (SEC334) - AWS re:Inv...Operational Excellence for Identity & Access Management (SEC334) - AWS re:Inv...
Operational Excellence for Identity & Access Management (SEC334) - AWS re:Inv...
 
Agile Gurugram 2023 I Metrics and Business Agility - Dinker Charak
Agile Gurugram 2023 I Metrics and Business Agility - Dinker CharakAgile Gurugram 2023 I Metrics and Business Agility - Dinker Charak
Agile Gurugram 2023 I Metrics and Business Agility - Dinker Charak
 
Agile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker Charak
Agile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker CharakAgile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker Charak
Agile Kolkata 2023 I EEBO Metrics in the Times of GenAI - Dinker Charak
 
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_SingaporePractical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
 
Build a complete security operations and compliance program using a graph dat...
Build a complete security operations and compliance program using a graph dat...Build a complete security operations and compliance program using a graph dat...
Build a complete security operations and compliance program using a graph dat...
 
Biz Talk Demo slideshare
Biz Talk Demo slideshareBiz Talk Demo slideshare
Biz Talk Demo slideshare
 
How McGraw Hill Uses Sumo Logic and AWS for Operational and Security Intellig...
How McGraw Hill Uses Sumo Logic and AWS for Operational and Security Intellig...How McGraw Hill Uses Sumo Logic and AWS for Operational and Security Intellig...
How McGraw Hill Uses Sumo Logic and AWS for Operational and Security Intellig...
 
Webinar- GBA Episode 4 – Enterprise Blockchain Adoption “Security & Adoption”
Webinar- GBA Episode 4 – Enterprise Blockchain Adoption “Security & Adoption”Webinar- GBA Episode 4 – Enterprise Blockchain Adoption “Security & Adoption”
Webinar- GBA Episode 4 – Enterprise Blockchain Adoption “Security & Adoption”
 
Advanced Security Automation Made Simple
Advanced Security Automation Made SimpleAdvanced Security Automation Made Simple
Advanced Security Automation Made Simple
 
Core strategies to develop defense in depth in AWS
Core strategies to develop defense in depth in AWSCore strategies to develop defense in depth in AWS
Core strategies to develop defense in depth in AWS
 
Managing Security of Large IoT Fleets (IOT321-R1) - AWS re:Invent 2018
Managing Security of Large IoT Fleets (IOT321-R1) - AWS re:Invent 2018Managing Security of Large IoT Fleets (IOT321-R1) - AWS re:Invent 2018
Managing Security of Large IoT Fleets (IOT321-R1) - AWS re:Invent 2018
 
Tagging Best Practices for Cloud Governance
Tagging Best Practices for Cloud GovernanceTagging Best Practices for Cloud Governance
Tagging Best Practices for Cloud Governance
 
Implementing Governance as Code
Implementing Governance as CodeImplementing Governance as Code
Implementing Governance as Code
 
Value Stories - 3rd issue - April 2019
Value Stories - 3rd issue - April 2019Value Stories - 3rd issue - April 2019
Value Stories - 3rd issue - April 2019
 
How to Streamline Testing in DevOps With Behavior Driven Development
How to Streamline Testing in DevOps With Behavior Driven DevelopmentHow to Streamline Testing in DevOps With Behavior Driven Development
How to Streamline Testing in DevOps With Behavior Driven Development
 

Recently uploaded

Standard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power PlayStandard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power Play
Epec Engineered Technologies
 
Introduction to Robotics in Mechanical Engineering.pptx
Introduction to Robotics in Mechanical Engineering.pptxIntroduction to Robotics in Mechanical Engineering.pptx
Introduction to Robotics in Mechanical Engineering.pptx
hublikarsn
 
"Lesotho Leaps Forward: A Chronicle of Transformative Developments"
"Lesotho Leaps Forward: A Chronicle of Transformative Developments""Lesotho Leaps Forward: A Chronicle of Transformative Developments"
"Lesotho Leaps Forward: A Chronicle of Transformative Developments"
mphochane1998
 
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
HenryBriggs2
 
1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf
1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf
1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf
AldoGarca30
 

Recently uploaded (20)

Signal Processing and Linear System Analysis
Signal Processing and Linear System AnalysisSignal Processing and Linear System Analysis
Signal Processing and Linear System Analysis
 
Online electricity billing project report..pdf
Online electricity billing project report..pdfOnline electricity billing project report..pdf
Online electricity billing project report..pdf
 
Computer Networks Basics of Network Devices
Computer Networks  Basics of Network DevicesComputer Networks  Basics of Network Devices
Computer Networks Basics of Network Devices
 
UNIT 4 PTRP final Convergence in probability.pptx
UNIT 4 PTRP final Convergence in probability.pptxUNIT 4 PTRP final Convergence in probability.pptx
UNIT 4 PTRP final Convergence in probability.pptx
 
COST-EFFETIVE and Energy Efficient BUILDINGS ptx
COST-EFFETIVE  and Energy Efficient BUILDINGS ptxCOST-EFFETIVE  and Energy Efficient BUILDINGS ptx
COST-EFFETIVE and Energy Efficient BUILDINGS ptx
 
Path loss model, OKUMURA Model, Hata Model
Path loss model, OKUMURA Model, Hata ModelPath loss model, OKUMURA Model, Hata Model
Path loss model, OKUMURA Model, Hata Model
 
Augmented Reality (AR) with Augin Software.pptx
Augmented Reality (AR) with Augin Software.pptxAugmented Reality (AR) with Augin Software.pptx
Augmented Reality (AR) with Augin Software.pptx
 
Computer Graphics Introduction To Curves
Computer Graphics Introduction To CurvesComputer Graphics Introduction To Curves
Computer Graphics Introduction To Curves
 
Ground Improvement Technique: Earth Reinforcement
Ground Improvement Technique: Earth ReinforcementGround Improvement Technique: Earth Reinforcement
Ground Improvement Technique: Earth Reinforcement
 
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKARHAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
 
Standard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power PlayStandard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power Play
 
Introduction to Robotics in Mechanical Engineering.pptx
Introduction to Robotics in Mechanical Engineering.pptxIntroduction to Robotics in Mechanical Engineering.pptx
Introduction to Robotics in Mechanical Engineering.pptx
 
"Lesotho Leaps Forward: A Chronicle of Transformative Developments"
"Lesotho Leaps Forward: A Chronicle of Transformative Developments""Lesotho Leaps Forward: A Chronicle of Transformative Developments"
"Lesotho Leaps Forward: A Chronicle of Transformative Developments"
 
Employee leave management system project.
Employee leave management system project.Employee leave management system project.
Employee leave management system project.
 
Introduction to Data Visualization,Matplotlib.pdf
Introduction to Data Visualization,Matplotlib.pdfIntroduction to Data Visualization,Matplotlib.pdf
Introduction to Data Visualization,Matplotlib.pdf
 
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
 
1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf
1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf
1_Introduction + EAM Vocabulary + how to navigate in EAM.pdf
 
Online food ordering system project report.pdf
Online food ordering system project report.pdfOnline food ordering system project report.pdf
Online food ordering system project report.pdf
 
Memory Interfacing of 8086 with DMA 8257
Memory Interfacing of 8086 with DMA 8257Memory Interfacing of 8086 with DMA 8257
Memory Interfacing of 8086 with DMA 8257
 
Introduction to Serverless with AWS Lambda
Introduction to Serverless with AWS LambdaIntroduction to Serverless with AWS Lambda
Introduction to Serverless with AWS Lambda
 

Owasp devslop how to implement an effective cloud resource tagging strategy using ia c