Auditing continuously

In Chapter 2, Defining Boundaries and Letting Go, we covered the topic of governance and the impact it can have on the speed of innovation. Governance covers a wide spectrum of subjects, but by and large we focus on security and the compliance of a system with security regulations, such as NIST, PCI, GDPR, and HIPAA, plus internal policies and best practices. Throughout this chapter we have covered how to secure our serverless systems in depth and by design. Now we need to ensure that we are doing so and not straying of course.Continuous auditing is an approach to governance that allow us to put guardrails in place without impeding the speed of innovation. We will look at automating audits at build-time and run-time and then look at how our architecture helps us audit the users of the system as well.

Build-time and run-time auditing

Confidence and automation are prerequisites for continuous deployment and delivery. Teams that are unsure about the security of their...