The document outlines a policy management solution for T-Mobile, addressing the challenges of compliance auditing due to the lack of a central source of truth for policy definitions and compliance statuses. The proposed solution, termed 'policy as code', automates compliance validation and reporting, streamlines remediation processes, and introduces features like continuous compliance assessment and self-service portals. The architecture supports multiple cloud environments and includes customizable dashboards and role-based access control.

1. T-Mobile Technology
Santhoshi Gorle
T-Mobile Confidential
Senior Software Engineer

2. 22 T-MobileConfidential

3. 3
Problem Statement
 No central source of truth for policy definition, compliance status, open issues,
granted exceptions (audit finding)
 In current state audits are resource intensive, costly and best-case only insure
compliance at a point in time (audit finding)
 Policy defined solely as human-read text is ambiguous, open to interpretation
and difficult to measure
 Environments and policies change too often to manually check or remediate.
Scale is too large to be effectively managed by a centralized team

4. 4
Solution:Policy as Code
 Policy and rules are described in code
and NOT IN DOCUMENTS
 Automated – compliance rules are
automatically validated
 Reporting – Compliance dashboard and
traceable evidence
 Remediation – Automatic or one-click
Describe
Discover
Scan
Log
Notify
Remedia
te

5. 5T-MobileConfidential

6. 6T-MobileConfidential
https://github.com/tmobile/pacbot
PacBot OSS

7. 7T-MobileConfidential
FAQ’s

8. 8Cloud Strategy & Development
8
T-Mobile Confidential
Thank You

9. 9
Data Collector / Shipper
Rule Engine
UI & MicroServicesElastic Search
S3
Auto Fix
End User
RDS
RedShift
CloudWatch
Rules
CloudWatch
Rules
ALB
VPC
PacBot Architecture

10. 10T-MobileConfidential
 Continuous compliance assessment.
 Detailed compliance reporting.
 Auto-Fix for policy violations.
 Omni Search - Ability to search all discovered resources.
 Simplified policy violation tracking.
 Self-Service portal.
 Custom policies and custom auto-fix actions.
 Dynamic asset grouping to view compliance.
 Ability to create multiple compliance domains.
 Exception management.
 Email Digests.
 Supports multiple AWS accounts.
 Completely automated installer.
 Customizable dashboards.
 OAuth Support.
 Azure AD integration for login.
 Role-based access control.
 Asset 360 degree
PacBot Capabilities