Compliance Engineering Platform

Compliance Guardrails Pipeline

Live

Policy-as-code

NIST 800-53 OPA / Rego AWS

Most cloud security incidents don't start with a sophisticated attacker. They start with a misconfigured S3 bucket, an overpermissioned IAM role, or a security group open to the entire internet. Someone made a change, nobody caught it, and the damage was done.

This pipeline catches those misconfigurations at the moment they are made. Before code ships, before infrastructure deploys, before anything reaches production. Policy violations block the pull request automatically. No manual review required.

94%

Reduction in violations reaching production

Manual security reviews in the release cycle

2-4 days

Saved per release previously spent on review

Try it. Run a policy scan

Select a misconfigured infrastructure template and watch the pipeline evaluate it against the NIST 800-53 policy set in real time.

Evaluating against NIST 800-53 policy set...

Recent evaluations

How it works

01

Engineer opens a pull request

Any IaC change (Terraform, CloudFormation, or raw policy) triggers the pipeline on every PR.
02

Conftest evaluates the template

The OPA/Rego policy library runs against the submitted template. Every resource type is checked against its mapped NIST 800-53 controls.
03

Violations block the merge

Any policy failure returns a detailed report showing which rule fired, which resource, which control reference, and the PR cannot merge until it is resolved.
04

Results written to the evidence vault

Every evaluation result is stored in DynamoDB and synced to the S3 Object Lock evidence vault. Auditors get a timestamped, tamper-evident record of every gate evaluation.

Stack

OPA / Rego Conftest GitHub Actions Lambda API Gateway DynamoDB S3 Object Lock CloudFront NIST 800-53

Part of the Compliance Engineering Platform, built from the OPA/Rego policy library and Conftest gate developed across 11 labs. This is what those controls look like running in a real deployment pipeline.

Changelog

Jul 6, 2026 Interactive demo launched. Three template scenarios live: S3 public ACL, IAM wildcard, security group open ingress.

Jul 6, 2026 API Gateway endpoint wired to Lambda evaluation engine. Results writing to DynamoDB evaluation log.

Jul 5, 2026 Rego policy library extended to cover RDS public accessibility and unencrypted EBS volumes.

Jul 3, 2026 NIST 800-53 control references mapped to all existing policies. Every violation now returns the specific control identifier.

↗ GitHub repo ← Back to platform ← All projects