Compliance and Governance in Cloud

How do you implement compliance and governance controls in a cloud-native environment?

Securityadvanced

// interview question

How do you implement compliance and governance controls in a cloud-native environment?

Sample answer

Cloud compliance involves policies, automation, and audit capabilities. Key components: 1) Policy-as-code (OPA/Gatekeeper, AWS SCPs) to enforce rules automatically. 2) Tagging standards for resource ownership/cost tracking. 3) Centralized logging and audit trails. 4) Network segmentation and least-privilege IAM. 5) Encryption at rest and in transit. 6) Regular compliance scanning (Prowler, ScoutSuite). 7) Change management processes. Frameworks to consider: SOC2, HIPAA, PCI-DSS, GDPR depending on industry. Shift compliance left - catch violations before deployment.

Why this matters

Compliance isn't just checkbox exercises - it's about building secure, auditable systems. Cloud makes compliance both easier (APIs for everything) and harder (velocity of change). Modern approaches embed compliance into CI/CD: policy checks in pipelines, infrastructure scanning, and continuous monitoring. The goal is making compliant the default, not an afterthought.

Code examples

OPA Gatekeeper policy

yaml

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-team-label
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Namespace"]
  parameters:
    labels:
    - key: team
    - key: environment
    - key: cost-center
    message: "All namespaces must have team, environment, and cost-center labels"

AWS Service Control Policy

hcl

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonApprovedRegions",
      "Effect": "Deny",
      "NotAction": [
        "iam:*",
        "organizations:*",
        "support:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "eu-west-1"
          ]
        }
      }
    },
    {
      "Sid": "RequireEncryption",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": "true"
        }
      }
    }
  ]
}

Common mistakes to avoid

Treating compliance as a one-time project instead of continuous process
Relying solely on manual reviews that can't scale
Not documenting exceptions and their justifications

Likely follow-ups

How do you handle compliance in a rapidly changing environment with frequent deployments?
What is the difference between preventive and detective controls?
How do you prepare for and conduct compliance audits?

Answer out loud first, then check yourself against the model answer.

Practice all Senior questions More Security questions

#compliance#governance#security#policy#cloud

Also worth your time on this topic

Checklist

AWS Security Checklist

Essential security configuration checklist for AWS cloud environments.

45-60 minutes

Interview

AWS VPC Networking Fundamentals

Explain the difference between public and private subnets in AWS VPC. How do instances in private subnets access the internet?

junior

Quiz

HashiCorp Vault Secrets Management Quiz

Test how you run HashiCorp Vault in production: dynamic database credentials, leases and TTLs, least-privilege policies, AppRole and Kubernetes auth, the Transit engine, auto-unseal, audit logging, and fast revocation when something gets compromised.

20-25 minutes

Compliance and Governance in Cloud

More Security interview questions

Also worth your time on this topic

AWS Security Checklist

AWS VPC Networking Fundamentals

HashiCorp Vault Secrets Management Quiz