DevOps compliance automation

operator: z.string(), evidenceUri: z.string(), });

type Evidence = z.infer<typeof EvidenceSchema>;

export class ComplianceOrchestrator { private s3: S3Client; private bucket: string;

constructor(bucket: string) { this.s3 = new S3Client({ region: process.env.AWS_REGION || "us-east-1" }); this.bucket = bucket; }

async runPolicyCheck(policyPath: string, targetPath: string): Promise<boolean> { try { execSync(opa eval -i ${targetPath} -d ${policyPath} 'data.main.allow' --format raw, { stdio: "pipe" }); return true; } catch { return false; } }

async captureEvidence(policyId: string, resourceType: string, operator: string): Promise<Evidence> { const timestamp = new Date().toISOString(); const stateOutput = execSync("terraform output -json", { encoding: "utf-8" }); const stateHash = createHash("sha256").update(stateOutput).digest("hex");

const key = `evidence/${policyId}/${timestamp}-${stateHash}.json`;
const evidence: Evidence = {
  policyId,
  resourceType,
  timestamp,
  stateHash,
  operator,
  evidenceUri: `s3://${this.bucket}/${key}`,
};

await this.s3.send(
  new PutObjectCommand({
    Bucket: this.bucket,
    Key: key,
    Body: JSON.stringify(evidence, null, 2),
    ContentType: "application/json",
    Metadata: { "x-amz-checksum-algorithm": "SHA256" },
  })
);

return evidence;

}

async attest(policyId: string, resourceType: string, operator: string): Promise<Evidence> { const passed = await this.runPolicyCheck(./policies/${policyId}.rego, "./infrastructure/"); if (!passed) throw new Error(Policy ${policyId} evaluation failed. Evidence not generated.); return this.captureEvidence(policyId, resourceType, operator); } }

This orchestrator evaluates OPA policies against infrastructure state, captures a cryptographic hash of the configuration, and stores an immutable evidence artifact. It integrates directly into CI/CD pipelines and provides auditors with verifiable, timestamped proof of compliance state.

## Pitfall Guide

1. **Treating Compliance as a Gate Instead of a Continuous Process**
   Blocking deployments on every policy violation creates friction and encourages workarounds. Implement tiered enforcement: block on critical/security violations, warn on informational, and automate remediation for low-risk drift.

2. **Over-Scanning Without Triage or Ownership**
   Running 50+ policy checks without clear ownership leads to alert fatigue. Map each policy to a team, define SLAs for remediation, and suppress known exceptions with documented risk acceptance.

3. **Ignoring Runtime Drift**
   CI/CD checks only verify declared state. Unauthorized console changes, manual patches, or third-party integrations cause drift. Schedule periodic reconciliation scans and enforce drift detection alerts.

4. **Hardcoding Policies Without Versioning**
   Policies that live outside version control cannot be audited, rolled back, or traced to changes. Store policies in Git alongside IaC, tag releases, and require PR reviews for policy modifications.

5. **Skipping Evidence Automation**
   Manual screenshots and spreadsheets fail under audit scrutiny. Automate state capture, hash generation, and artifact storage. Auditors require cryptographic proof, not PDF exports.

6. **Misaligning Policies with Actual Frameworks**
   Writing generic policies without mapping to SOC 2 CC6.1, ISO 27001 A.12.4, or HIPAA 164.312 creates coverage gaps. Maintain a policy-to-control mapping matrix and validate coverage quarterly.

7. **Centralizing Compliance Without Developer Feedback Loops**
   Compliance teams that operate in isolation produce policies engineers cannot implement. Embed compliance engineers in delivery teams, provide local policy testing tools, and publish clear remediation runbooks.

**Best Practices from Production:**
- Run policy evaluation in parallel with build steps to avoid pipeline latency.
- Use policy exceptions with expiration dates and automated reminders.
- Implement policy versioning with backward compatibility checks.
- Cache OPA evaluation results for identical manifests to reduce compute overhead.
- Generate attestation reports in standard formats (JSON, PDF with embedded hashes) for auditor consumption.

## Production Bundle

### Action Checklist
- [ ] Map regulatory controls to machine-readable policies: Translate SOC 2, ISO 27001, or HIPAA requirements into OPA/Rego or Checkov rules with explicit control IDs.
- [ ] Integrate policy evaluation into CI/CD: Add OPA or Checkov steps to pull request and merge pipelines with tiered enforcement (block/warn/inform).
- [ ] Deploy evidence orchestrator: Implement a TypeScript/Node.js service that captures infrastructure state, hashes configurations, and stores immutable artifacts.
- [ ] Configure runtime drift detection: Schedule periodic reconciliation scans against live infrastructure and route alerts to responsible teams.
- [ ] Establish policy version control: Store all policies in Git, require PR reviews for changes, and tag releases for audit traceability.
- [ ] Build audit attestation pipeline: Automate report generation with cryptographic proofs, timestamps, and operator attribution for quarterly reviews.
- [ ] Define exception management workflow: Create a documented process for risk acceptance with expiration dates, automated reminders, and compliance sign-off.

### Decision Matrix

| Scenario | Recommended Approach | Why | Cost Impact |
|----------|---------------------|-----|-------------|
| Startup / MVP Phase | Checkov + GitHub Actions + S3 Evidence Store | Low overhead, rapid setup, covers core IaC security and compliance checks | Low: $0–50/mo in tooling |
| Enterprise / Multi-Cloud | OPA + GitLab CI + Central Evidence Orchestrator + Drift Detection | Cross-cloud consistency, policy reuse, scalable evidence management | Medium: $200–800/mo in compute & storage |
| Regulated / Healthcare | OPA + Kubernetes Policy Engine + Immutable Audit Vault + Automated Attestation | Strict audit requirements, cryptographic proof, runtime enforcement, HIPAA alignment | High: $1,500–3,000/mo in security & compliance tooling |

### Configuration Template

**GitHub Actions Workflow (`.github/workflows/compliance.yml`)**
```yaml
name: Compliance Pipeline
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup OPA
        uses: open-policy-agent/setup-opa@v2
        with:
          version: latest
      - name: Evaluate Policies
        run: |
          opa eval -i ./infrastructure/terraform.tfstate.json \
                   -d ./policies/ \
                   'data.main.allow' --format raw
      - name: Run Evidence Orchestrator
        env:
          AWS_REGION: us-east-1
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: |
          npm ci
          npx ts-node src/compliance-orchestrator.ts --policy SOC2-CC6-1 --resource terraform --operator ${{ github.actor }}

OPA Policy (policies/soc2_cc6_1.rego)

package main

allow {
  not input.resource.aws_s3_bucket[*].versioning.status == "Disabled"
  not input.resource.aws_iam_role[*].assume_role_policy contains "Action": "sts:AssumeRole" with "Effect": "Allow" without MFA condition
}

Quick Start Guide

1. Initialize Policy Repository: Create a policies/ directory, add OPA/Rego rules mapping to your target framework, and commit to version control.
2. Deploy Evidence Orchestrator: Clone the TypeScript orchestrator template, configure AWS credentials, and set the evidence bucket with Object Lock enabled.
3. Add CI/CD Integration: Insert the OPA evaluation and orchestrator steps into your pipeline YAML. Test against a sample Terraform state to verify policy evaluation and evidence generation.
4. Validate Audit Trail: Run a pipeline execution, verify the evidence artifact appears in S3, and confirm the JSON attestation contains a valid SHA-256 state hash and timestamp.
5. Enable Drift Detection: Schedule a cron job or GitHub Actions workflow to run reconciliation scans every 6 hours, routing drift alerts to your incident management system.