<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-compliance-automation
description: >-
  Implement automated compliance checking and remediation across AWS, Azure, and GCP
  using native services like AWS Config, Azure Policy, and GCP Organization Policy
  to enforce CIS benchmarks, SOC2, HIPAA, and PCI-DSS controls.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - compliance
  - aws-config
  - azure-policy
  - organization-policy
  - cis-benchmark
  - automation
  - remediation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Cloud Compliance Automation

## Overview

Cloud compliance automation replaces manual audits with continuous, policy-driven
assessment and remediation. AWS Config Rules, Azure Policy, and GCP Organization
Policy Constraints evaluate resource configurations in real time and can trigger
automatic remediation when violations are detected. This skill covers deploying
compliance-as-code using native cloud services mapped to CIS, SOC2, HIPAA, and
PCI-DSS frameworks.

Mode: `[MODE: BLUE]` with `[MODE: ARCHITECT]` layer — Compliance automation design.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, `gcloud` CLI configured | Required |
| AWS | `config:*`, `securityhub:*` permissions |
| Azure | `Policy Contributor`, `Security Admin` roles |
| GCP | `orgpolicy.policy.get`, `securitycenter.findings.list` |
| Python 3.10+ with `boto3` | Required |

## Key Concepts

### AWS Config — Compliance Rules

```bash
# Enable AWS Config
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=$CONFIG_ROLE_ARN

# Deploy CIS benchmark conformance pack
aws configservice put-conformance-pack \
  --conformance-pack-name "CIS-AWS-Foundations" \
  --template-s3-uri "s3://aws-configservice-us-east-1/conformance-packs/Operational-Best-Practices-for-CIS-AWS-v1.4-Level1.yaml"

# Check compliance summary
aws configservice get-compliance-summary-by-config-rule

# Get non-compliant resources for a rule
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name "s3-bucket-server-side-encryption-enabled" \
  --compliance-types NON_COMPLIANT

# Enable auto-remediation
aws configservice put-remediation-configurations \
  --remediation-configurations '[{
    "ConfigRuleName": "s3-bucket-server-side-encryption-enabled",
    "TargetType": "SSM_DOCUMENT",
    "TargetId": "AWS-EnableS3BucketEncryption",
    "Automatic": true,
    "MaximumAutomaticAttempts": 3,
    "RetryAttemptSeconds": 60
  }]'

# AWS Security Hub — aggregate compliance
aws securityhub get-findings --filters '{
  "ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}],
  "SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}]
}'
```

### Azure Policy — Compliance Enforcement

```bash
# List built-in policy initiatives
az policy set-definition list --query "[?policyType=='BuiltIn'].{Name:displayName,Id:name}" --output table | head -20

# Assign CIS benchmark initiative
az policy assignment create \
  --name "CIS-Azure-Benchmark" \
  --display-name "CIS Microsoft Azure Foundations Benchmark" \
  --policy-set-definition "1a5bb27d-173f-493e-9568-eb56638dde4d" \
  --scope "/subscriptions/$SUBSCRIPTION_ID"

# Check compliance state
az policy state summarize --query "value[?results.nonCompliantResources > \`0\`].{Policy:policyAssignmentId,NonCompliant:results.nonCompliantResources}" \
  --output table

# List non-compliant resources
az policy state list --filter "complianceState eq 'NonCompliant'" \
  --query "[].{Resource:resourceId,Policy:policyDefinitionName}" --output table

# Create remediation task
az policy remediation create \
  --name "remediate-encryption" \
  --policy-assignment $ASSIGNMENT_ID \
  --resource-group $RG
```

### GCP Organization Policy Constraints

```bash
# List organization policy constraints
gcloud org-policies list --organization=$ORG_ID --format="table(constraint,listPolicy,booleanPolicy)"

# Enforce uniform bucket-level access
gcloud org-policies set-policy \
  --organization=$ORG_ID \
  /tmp/uniform-bucket-policy.yaml

# Check SCC compliance
gcloud scc findings list $ORG_ID \
  --filter='category="COMPLIANCE_VIOLATION"' \
  --format="table(finding.category,finding.severity,resourceName)"

# Enable Security Health Analytics
gcloud scc settings update \
  --organization=$ORG_ID \
  --enable-modules SECURITY_HEALTH_ANALYTICS
```

## Workflow

### Step 1: Deploy Compliance Framework

```bash
# AWS — deploy Security Hub with CIS standard
aws securityhub enable-security-hub --enable-default-standards
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[{"StandardsArn":"arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0"}]'
```

### Step 2: Run Compliance Assessment

```bash
node scripts/agent.js --provider aws --framework cis --output /tmp/compliance.json
```

## Verification

- [ ] AWS Config/Azure Policy/GCP Org Policy deployed in all accounts
- [ ] CIS benchmark conformance pack assigned and evaluating
- [ ] Auto-remediation enabled for critical compliance rules
- [ ] Security Hub/Defender/SCC aggregating compliance findings
- [ ] Non-compliant resource count trending downward
- [ ] Compliance reports generated for audit evidence
- [ ] Exception/waiver process documented for accepted risks

## References

- [AWS Config Conformance Packs](https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html)
- [Azure Policy Built-in Definitions](https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies)
- [GCP Organization Policy Constraints](https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
