Compliance and Governance in Cloud

How do you implement compliance and governance controls in a cloud-native environment?

Securityadvanced

// interview question

How do you implement compliance and governance controls in a cloud-native environment?

Sample answer

Cloud compliance involves policies, automation, and audit capabilities. Key components: 1) Policy-as-code (OPA/Gatekeeper, AWS SCPs) to enforce rules automatically. 2) Tagging standards for resource ownership/cost tracking. 3) Centralized logging and audit trails. 4) Network segmentation and least-privilege IAM. 5) Encryption at rest and in transit. 6) Regular compliance scanning (Prowler, ScoutSuite). 7) Change management processes. Frameworks to consider: SOC2, HIPAA, PCI-DSS, GDPR depending on industry. Shift compliance left - catch violations before deployment.

Why this matters

Compliance isn't just checkbox exercises - it's about building secure, auditable systems. Cloud makes compliance both easier (APIs for everything) and harder (velocity of change). Modern approaches embed compliance into CI/CD: policy checks in pipelines, infrastructure scanning, and continuous monitoring. The goal is making compliant the default, not an afterthought.

Code examples

OPA Gatekeeper policy

yaml

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-team-label
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Namespace"]
  parameters:
    labels:
    - key: team
    - key: environment
    - key: cost-center
    message: "All namespaces must have team, environment, and cost-center labels"

AWS Service Control Policy

hcl

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonApprovedRegions",
      "Effect": "Deny",
      "NotAction": [
        "iam:*",
        "organizations:*",
        "support:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "eu-west-1"
          ]
        }
      }
    },
    {
      "Sid": "RequireEncryption",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": "true"
        }
      }
    }
  ]
}

Common mistakes to avoid

Treating compliance as a one-time project instead of continuous process
Relying solely on manual reviews that can't scale
Not documenting exceptions and their justifications

Likely follow-ups

How do you handle compliance in a rapidly changing environment with frequent deployments?
What is the difference between preventive and detective controls?
How do you prepare for and conduct compliance audits?

Answer out loud first, then check yourself against the model answer.

Practice all Senior questions More Security questions

#compliance#governance#security#policy#cloud

Also worth your time on this topic

Checklist

AWS Security Checklist

Essential security configuration checklist for AWS cloud environments.

45-60 minutes

Article

Meta Says Every Muse User Gets Their Own VM

Meta says its new consumer agent runs on a dedicated cloud VM per person, with a second agent that has to approve anything leaving that machine and a credential store the agent can use but never read. Those are three infrastructure decisions you face too. Here is what each one defends against, what it costs to build, and a runnable model of the broker, including the injected page that tries to walk out with a token.

Interview

AWS VPC Networking Fundamentals

Explain the difference between public and private subnets in AWS VPC. How do instances in private subnets access the internet?

junior

Compliance and Governance in Cloud

More Security interview questions

Also worth your time on this topic

AWS Security Checklist

Meta Says Every Muse User Gets Their Own VM

AWS VPC Networking Fundamentals