Automating reporting on compliance controls at cloud scale
summary
Tally uses Datadog to translate vague PCI controls into concrete AWS tests, mapping controls to resources via Datadog CSM and Rego/OPA rules; infrastructure-as-code (Terraform + common modules + Atlantis) lets a single module update cascade, and a one-line change fixed hundreds of findings. The stack runs Bottlerocket on Karpenter, deploys ~10x/day with ~7‑hour lead time, avoided thousands of Jira tickets, added file integrity monitoring in two days, and uses CIEM and workflows to automate remediation and reporting.
AI-written summary · about
chapters (10)
- 0:00Introduction to compliance
- 2:29Defining the compliance problem
- 7:01Tally's operational strategy
- 10:59Engineering compliance zones
- 14:19Mapping controls with Datadog
- 18:26Remediating security findings
- 22:48Customizing rules and monitoring
- 27:29Data-driven security insights
- 30:45Incident response in the cloud
- 33:23Identity risk and conclusion
related talks
33mCompliance as Code - Lessons Learned From Regulated Organizations
53mEmpowering small teams with Amazon ECS Fargate and Datadog
48mSecuring Your Pipes with a TACO
36mImproving Security while Reducing Toil with DevSecOps
29mAutomating Continuous Compliance for Scalable SaaS Delivery
14mThe power of preventative cloud security with Tenable and
56mCloud compliance journey: Compliance and audits
32mAutomating Security Compliance at Scale