Compliance
Another area I'm learning as I go, because it's in nearly every cloud job description I read. Not legal advice and not an auditor's course: enough to read a job description, talk to an auditor, and point at the evidence in systems I actually run.
Learning track · 7 lessons
Compliance for cloud engineers
From what a control is to mapping a real system against one. Each lesson ties a framework's rules to everyday engineering, like access, encryption, logging and change history, and ends with CivicGrid checked against real NIST 800-53 controls.
- 1What compliance is: frameworks, controls and evidenceStart · 20 min
- 2The frameworks in job descriptionsStart · 25 min
- 3Controls in engineering termsStart · 25 min
- 4Evidence without the pain: Git, Terraform and GitOpsStart · 25 min
- 5Policy as code: checking the rules automaticallyStart · 35 min
- 6The federal path: RMF, FedRAMP and the ATOStart · 25 min
- 7Map a real system: CivicGrid against NIST 800-53Start · 30 min
Where to start
NIST SP 800-53 (opens in a new tab)
The catalogue of security controls behind most US federal requirements.
FedRAMP (opens in a new tab)
The US government's program for authorizing cloud services, with its own guides and templates.
Checkov (opens in a new tab)
An open-source scanner that checks Terraform and Kubernetes files against security rules.
From www.kwamib.dev/resources/compliance
Git
Linux
Python
SQL
Networking and DNS
Docker
Kubernetes
Terraform
CI/CD
Argo CD
Ansible
Monitoring and alerting
Automation
AWS
Security
Local LLMs
Web development
Career and certs