The automated DevSecOps governance model with Rego and Trivy
summary
Explains an automated DevSecOps governance model using Open Policy Agent Rego rules enforced during Trivy scans. Shows creating a Rego policy that requires storage buckets to be in an EU region, demonstrates finding a bucket in us-west1 (4 failing checks out of 15 on a sample repo), and describes failing pipelines on policy violations to prevent bad deployments; reports a measured ~70% drop in misconfiguration when shifting security left.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:06Misconfigurations and breaches
- 4:41DevSecOps principles
- 7:49SAST for infra code
- 9:37Trivy and OPA
- 11:01Using Trivy
- 14:49Trivy in pipelines
- 17:16Custom policies with Rego
- 21:33Terraform supply chain threats
- 24:25Terraform module attacks
- 31:12Summary
related talks
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
36mOpen Policy Agent: security for cloud natives and everyone else
30mEnhance your Compliance with Policy-Based CI/CD
15mSecuring your Deployments using a Policy Driven Approach
18mDevOps All the Things: Creating a Pipeline to Validate Your OPA Policies
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
25mThe Battle of Policies: OPA’s Rego vs. JSON Schema