►
From YouTube: Lightning Talk: Compliance Operations (CompOps) with Armory Spinnaker in AWS - Thomas McGonagle
Description
Sponsored Lightning Talk: Compliance Operations (CompOps) with Armory Spinnaker in AWS - Thomas McGonagle, Armory
The role of Armory Spinnaker as the central CD orchestrator in AWS, positions it to play a significant role in the burgeoning AWS CompOps movement. Compliance is critical to many organizations and should be incorporated into their larger DevOps culture. Iron Mountain says, the benefits of developing a compliance driven culture is that the "compliance program can ultimately help you cut your operational costs, improve efficiencies and reduce risks. Once you've developed your plan, you can relax—at least a little—knowing that you're well set up to:" * Demonstrate your adherence to laws and regulations * Speed your response times when audits or litigation occur * Reduce the risk of fines and penalties * Improve your business efficiencies * Reduce your administrative costs * Get control over your critical records
For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/
A
Hello
and
welcome
to
my
talk
on
compliance
operation,
comp
ops
with
armory
and
aws,
I'm
thomas
mcgonagall,
I'm
a
cloud
partner
solution
architect
at
armory.
If
you
want
to
learn
more
about
me
or
connect
with
me
on
linkedin
or
whatever
you
can
go
to
my
linktree
mcgonagall,
what
is
compliance
and
what
is
a
compliance
program?
Well,
a
compliance
program
can
ultimately
help
you
cut
your
operational
costs,
improve
efficiencies
and
reduce
risk.
A
What
is
compliance?
Well,
it's
a
regulatory
framework.
There
are
policies,
standards
and
risks
and
the
corresponding
documentation
that
encapsulates
those
risks,
policies
and
standards.
How
is
it
different
from
security?
Well,
security
encompasses
physical
controls,
secure
I.t
environments,
authentication
mechanisms,
network
access,
business
processes
and
so
forth,
and
compliance
is
the
regulatory
bodies
of
information
that
that
encapsulate
security
and
enforce
security,
best
practices
and
procedures
and
what
are
some
examples
of
compliance?
A
What
is
compost
you
know
just
like
devops,
it's
people
process
and
technology.
It's
the
encapsulation
of
those
regulatory
frameworks
into
corresponding
infrastructure,
as
code
and
continuous
delivery
pipelines
to
encapsulate
this
continuous
delivery
and
actually
become
comp,
ops
and
compliance
and
operations
for
enterprises
and
and
and.
A
What's
my
personal
definition
of
devops?
Well,
it's
a
technical
and
cultural
focus
on
the
software
delivery
mission.
It's
a
mission!
It's
it's
all
about
the
delivery
mission.
It's
all
about
the
software
delivery
mission,
it's
all
about
the
technical
and
cultural
focus
that
we
have
on
delivering
software
rapidly
and
quickly.
A
What
does
compost
allow
you
to
do?
It
allows
you
to
demonstrate
your
adherence
to
laws
and
regulations?
What
is
it?
It
speeds
your
response
times
when
audits
or
litigation
occur.
It
reduces
the
risk
of
fines
and
penalties.
It
improves
your
business
efficiencies.
It
reduces
your
administrative
costs,
it
gets
control
over
your
critical
records
and
it
does
all
these
things,
but
through
the
enforcement
of
devops
best
practices
and
in
and
in
in
to
to
the
art
and
science
of
compliance,
and
so
what
is
the
the
seven
devops
practices
that
I'm
referring
to?
A
And
this
comes
from
the
enterprise
devops
playbook,
the
o'reilly
book
published
by
our
friends
at
booz,
allen,
hamilton
and
they
are
practice.
One
configuration
management
practice,
two
continuous
integration
practice:
three,
automated
testing
practice,
four
infrastructure
as
code
practice,
five
continuous
delivery
practice,
six
continuous
deployment
practice,
seven
continuous
monitoring.
So
this
slide,
I
feel,
is
incredibly
important.
A
I
believe
that
all
six
sexy,
all
seven
practices
are
correspond
to
compliance
operations,
comp
ups
and
if
you
look
at,
if
we
could
talk
for
days
about
things
like
continuous
monitoring
and
infrastructure
as
code
and
automated
testing,
but
really
what
we're
focusing
on
today
is
continuous
delivery
and
then
why?
Why
are
we
focusing
on
continuous
delivery?
Because
continuous
delivery
has
the
opportunity
to
be
the
man
in
the
middle
to
be
the
center
to
be
the
the
very
the
very
center
of
your
software
delivery
pipeline?
A
So
what
are
some
of
these
benefits?
Well,
automation
with
open
policy.
Agent
provides
benefits
of
repeatability
agility,
scalability
reassurance,
disaster
recovery
and
reassurances
means
documentation,
and
these
these
five
benefits
are
incredibly
incredibly
powerful
for
a
compliance
driven
organization
and
a
compliance
driven
software
development
practice.
A
What
are
some
of
the
principles
of
comp
ops?
Well,
it's
declarative
with
open
policy
agent.
You
get
this
declarative
specification
of
your
policies.
They're,
abstract,
we're
we're
we're
abstracting
out
the
implementation
details
of
the
compliance
project
where
their
item
potent
action
can
be
taken
once
and
enforcement
of
your
project
and
of
your
pipelines
can
be
enforced
using
comps
and
using
the
open
policy
agent
and
the
convergent
over
time
they
lend
towards
us
towards
correctness.
A
Similarly,
what
are
some
of
the
benefits?
Well,
the
comp
box
project
with
compos
theory
with
with
the
open
policy
agent,
has
the
following
benefits:
it's
modular,
it's
cooperative!
You
can
you
can
cooperate
with
others
and
on
your
policies
and
on
your
on
your
compliance
projects.
You're
using
this
one
standardized
policy
agent,
language
called
rego,
you
have
composability,
you
have
extensibility
and
you
have
flexibility
and
what
are
the
impact?
What's
the
impact
of
comp
ups?
Well,
it's
going
to
improve
your
speed.
A
It's
going
to
make
your
compliance
and
your
security
faster
and
more
and
make
your
deployments
workload
faster
and
more
more
speedy.
It
creates
predictability.
You
can
drastically
reduce
risk
of
human
error,
it
provides
management,
you
can
centrally
govern
and
monitor
systems
and
workloads,
it
can
increase
responsiveness
and
it
can
and
it
can
foster
collaboration
and
so
at
aws.
A
We
can
do
that
through
this
governance
risk
and
compliance
approach-
and
this
is
this-
comes
from
a
blog
from
aws,
and
I
just
want
to
call
everyone's
attention
to
the
compliance
the
rightmost
chevrons,
and
so
we
have
commander
the
threat
landscape,
implement
controls
inside
our
behavioral
analysis.
We
have
self-assess
system
processes,
audit
preparation,
we
have
regulatory
audits,
standards,
audits
and
contractual
audits,
and
we
have
reporting
internal
regulatory
bodies
and
customers.
A
Hi
everyone,
I
believe
I
have
a
few
minutes
for
questions
and
answers
about
the
lightning
talk.
It
was
a
pleasure
to
have
you
all,
listen
to
this
concept
of
comp
ops
and
it's
the
application
of
devops
principles
and
practices
to
the
compliance
arena,
and
does
anyone
have
any
questions
that
they
can
post
in
the
q?
A
does
anyone
have
any
if,
if
not,
we
could
keep
going
through
and
asking
people
what
their
first
jobs
were?
Does
anyone
have
any
questions
about
comps
and
open
policy
agent
and
how
it
facilitates
this?
A
A
A
A
So
we
don't
really
have
a
lot
of
questions,
so
you
know
I
just
want
to
kind
of
pull
the
the
team
is.
Is
compliance
important
to
you
in
your
day-to-day
job?
If
you're
welcome
to
put
in
the
chat
you're
welcome
to
put
in
the
q
a
whatever
is
whatever
is
easiest
for
you
and
you
know.
If
you
remember
I
had
this
slide,
I
can
bring
it
up,
but
I
can
take
me
a
minute,
but
compliance
is
regulations
and
it's
documentation
and
all
those
good
things-
and
it
is
different
from
security.
A
A
Yeah
so
stan
just
said
how
great
our
logo
is.
I
actually
have
it
if
you
can
see.
I
have
it
hanging
up
in
my
my
my
wall.
I
love
the
the
armory
logo.
I
think
it's
like
inspired.
So
if
you
look
at
it
closely,
it's
a
shield.
You
know
for
armory,
and
then
it's
got
these
clouds
inside
this
inside
the
shield.
So
it's
you
know
we're
cloud
armory.
A
A
So
stan's
digging
into
oppa.
How
can
it
enable
compliance
and
pipelines
to
ensure
we're
enabling
team
teams
access
to
pipelines
while
ensuring
we
are
meeting
organizational
needs?
So
oppa
has
this
language
rego
and
you
can
define
your
compliance
requirements
for
a
pipeline.
So,
let's
just
say
you
needed
to
have
manual
judgments
before
any
push
to
production.
You
can
model
that
in
the
oppa
rigo
language
and
then
you
can
enforce
that
through
our
open
policy
product,
our
open
policy
agent
product,
and
so
our.
A
If
you
remember
there
was
like
a
graphic
where
it
had
all
the
the
spinnaker
microservices
and
they
were
reaching
out
to
to
the
opa
technology
product
and
they
were
determining
whether
or
not
the
the
pipeline
was
compliant
with
oppa,
and
so
so
I'm
going
to
give
that
sam.
That's
an
excellent
question,
so
I'm
just
going
to
give
that
one
more
shot
at
trying
to
answer
it.
So
the
the
oppa
technology
allows
you
to
model
your
compliance
requirements
for
your
cd
system.
A
A
Yeah,
I
just
wanted
to
thank
everyone
for
attending
our
session
today,
and
I
hope
you
found
my
lightning
talk
to
be
informative.
I
I
am
personally
very
interested
in
security.
I'm
not
sure
if
I
have
the
the
personality
for
security
for
security
work,
but
I'm
personally
very
interested
in
devsecops
and
it's
such
an
important
field
and
compliance
is
an
important
part
of
it
right
it
really.
A
It
really
really
is
it's
an
important
part
of
security
and
it's
an
important
part
of
of
making
our
systems
as
secure
as
possible
and
adhering
to
those
those
regulations
like
hipaa.
You
know,
like
I'm
intimately
familiar.
I've
been
spending
a
lot
of
time,
but
a
sick
baby.
I've
been
I've,
been
spending
a
lot
of
time
in
in
in
hospital
in
a
hospital
interacting
with
the
hipaa
requirements
and
gosh.
A
You
know
to
have
the
have
the
ability
to
abstract
those
out
and
to
model
and
then
models
the
right
verb
right
to
model
those
requirements
in
code
and
then
enforce
them
into
your
cd
pipeline
is
according
to
me,
just
magic
right
like
it's.
Just
it's
just
powerful,
powerful,
powerful
approach
to
to
compliance,
and-
and
I
mean
I
dare
to
say
that-
there's
probably
no
better
way
to
do
it
than
to
do
it
with
a
cd
and
with
oppa.
A
Oh,
here's
a
good
question
from
from
from
aws
with
spin
ecker,
I'm
excited
with
anonymous.
So
what
are
the
key
features?
Sorry,
sorry
anonymous!
I
missed
this
question
for
five
minutes
ago.
We
have
enough
time
to
answer
it.
So
what
are
the
key
features?
Do
we
get
with
the
collaboration
of
aws
and
spinnaker?
And
so
so
that's
that's.
My
purview,
I'm
in
the
cloud
partner
solution
group
at
armory-
and
you
know,
from
from
from
its
beginnings,
spinnaker,
has
been
highly
focused
on
amazon
aws.
A
You
know,
netflix
uses
leverages
spinnaker
for
their
their
ec2
infrastructure
and
we
have
support
now
for
all
the
different
kind
of
deployment
targets
and
that's
that's
the
right
expression
deployment
targets.
You
know
so
we
have
ec2,
we
have
eks,
we
have
excuse
me,
we
have
ecs,
we
have
lambda,
we
have
fargate
and
we
have
those
deployment
targets
and
the
the
the
the
focus
and
the
participation
on
aws
is
is
only
increasing.
A
We
we're
going
to
have
more
and
more
capabilities
and
features
and
and
products
and
and
and
focus
on
aws.
You
know,
interestingly
enough
aws
or
spinnaker
is
in
charge,
is
is
responsible
for
like
a
billion
dollars
of
aws
spend
you
know
if
you
think
about
it,
it
makes
sense
with
with
netflix
you
know,
being
a
third
of
the
internet
or
whatever
their
bandwidth
requirements
are,
and
so
so
you
know
so
spinnaker
and
aws
are
very,
very
tightly
connected
anonymous.
A
Please
let
me
know
if
that
doesn't
answer
your
question
or
if
you
have
any
other
additional
questions,
we
have
two
more
minutes.
I'd
be
happy
to
dig
into
that
or
if,
if
you
or
if
you
want
to
connect
with
me
through
linktree,
it's
linktree
slash
mcgonagall,
please
do
I
just
got
notified
that
on
that
time
it's
been
a
tremendous
pleasure
speaking
with
you
all
today
and
I
hope
to
connect
with
you
and
get
to
know
you
all,
and
I
hope
you
have
a
wonderful
afternoon.
Thank
you
very
much.