Policy as Code Bot (PacBot) is a platform for continuous compliance monitoring, compliance reporting and security automation for the cloud. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to gauge policy conformance.

1. T-Mobile Technology
Santhoshi Gorle
T-Mobile Confidential
Senior Software Engineer

2. 22 T-MobileConfidential

3. 3
Problem Statement
 No central source of truth for policy definition, compliance status, open issues,
granted exceptions (audit finding)
 In current state audits are resource intensive, costly and best-case only insure
compliance at a point in time (audit finding)
 Policy defined solely as human-read text is ambiguous, open to interpretation
and difficult to measure
 Environments and policies change too often to manually check or remediate.
Scale is too large to be effectively managed by a centralized team

4. 4
Solution:Policy as Code
 Policy and rules are described in code
and NOT IN DOCUMENTS
 Automated – compliance rules are
automatically validated
 Reporting – Compliance dashboard and
traceable evidence
 Remediation – Automatic or one-click
Describe
Discover
Scan
Log
Notify
Remedia
te

5. 5T-MobileConfidential

6. 6T-MobileConfidential
https://github.com/tmobile/pacbot
PacBot OSS

7. 7T-MobileConfidential
FAQ’s

8. 8Cloud Strategy & Development
8
T-Mobile Confidential
Thank You

9. 9
Data Collector / Shipper
Rule Engine
UI & MicroServicesElastic Search
S3
Auto Fix
End User
RDS
RedShift
CloudWatch
Rules
CloudWatch
Rules
ALB
VPC
PacBot Architecture

10. 10T-MobileConfidential
 Continuous compliance assessment.
 Detailed compliance reporting.
 Auto-Fix for policy violations.
 Omni Search - Ability to search all discovered resources.
 Simplified policy violation tracking.
 Self-Service portal.
 Custom policies and custom auto-fix actions.
 Dynamic asset grouping to view compliance.
 Ability to create multiple compliance domains.
 Exception management.
 Email Digests.
 Supports multiple AWS accounts.
 Completely automated installer.
 Customizable dashboards.
 OAuth Support.
 Azure AD integration for login.
 Role-based access control.
 Asset 360 degree
PacBot Capabilities