Avoiding IAC Potholes with Policy + Cloud Controllers
summary
Shows a concrete pipeline: Crossplane composite resources provision AWS S3/RDS, Kyverno validating admission controllers block noncompliant CRs, and Lula+OSCAL generate Kyverno policies from NIST 800-53 rev5-aligned component definitions. Demo rejects an insecure S3 bucket and permits an authorized one; tooling is mostly scripted glue (bash) but works end-to-end in the proof of concept. Repo with example policies and OSCAL components is slated for public release.
AI-written summary · about
chapters (7)
- 0:00Start
- 7:09Preventing misconfiguration with Policy Agents
- 12:20Crossplane
- 15:25Proof of Concept project
- 23:28Building OSCAL Profiles and Component Definitions
- 24:28Building S3 OSCAL documents for $3
- 25:16Oscal Component Definition
related talks
37mPath To Production: Sustainable Compliance In Strict Environments
22mOSCAL in Action: Real World Examples of Automating Policy & Comp...
42mSecuring the Invisible Hands: Policy and Guardrails for AI-Driven Infra...
33mSecuring Your Infrastructure as Code Pipeline
25mShift Left in Action: Automating CIS Compliance With Kyverno and CNCF Power Too...
40mCloud Native GRC
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
32mCloud Native Policy as Code: Principles and Best Practices