<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-continuous-compliance-monitoring
description: >-
  Deploy continuous compliance monitoring pipelines that evaluate infrastructure
  and application configurations against regulatory frameworks in real time.
  Integrates with OPA, Chef InSpec, AWS Config, and SIEM platforms for
  drift detection and automated remediation triggers.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - continuous-compliance
  - compliance-monitoring
  - drift-detection
  - opa
  - aws-config
  - automation
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Continuous Compliance Monitoring

## Overview

Continuous compliance monitoring replaces point-in-time audits with real-time
evaluation of infrastructure state against regulatory baselines. This skill
covers deploying monitoring pipelines using OPA/Gatekeeper, AWS Config Rules,
InSpec scheduled scans, and SIEM-based compliance dashboards to detect drift
and trigger remediation workflows.

Mode: `[MODE: BLUE]` — Proactive compliance posture management.

## Prerequisites

| Requirement | Install |
|---|---|
| OPA | `curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static` |
| InSpec | `gem install inspec` |
| AWS CLI | `pip install awscli` |
| Terraform | For infrastructure policy enforcement |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Compliance Monitoring Architecture

```
Data Sources → Policy Engine → Evaluation → Action
├── Cloud APIs (AWS Config, Azure Policy, GCP SCC)
├── Infrastructure scans (InSpec, ScoutSuite)
├── Container configs (Gatekeeper, Kyverno)
├── Application configs (OPA/Rego policies)
└── Log streams (SIEM correlation rules)
         │
         ▼
    ┌─────────────┐     ┌──────────────┐
    │ OPA / Rego   │────▶│ Compliance DB │
    │ InSpec       │     │ (findings)    │
    │ AWS Config   │     └──────┬───────┘
    └─────────────┘            │
                               ▼
                    ┌──────────────────┐
                    │ Alert / Remediate │
                    │ • Slack/PagerDuty │
                    │ • Auto-remediate  │
                    │ • Ticket creation │
                    └──────────────────┘
```

### OPA Rego Policy — Encryption at Rest

```rego
package compliance.encryption

default allow = false

allow {
    input.resource_type == "aws_ebs_volume"
    input.encrypted == true
}

violation[msg] {
    input.resource_type == "aws_ebs_volume"
    not input.encrypted
    msg := sprintf("EBS volume %s is not encrypted — violates CIS 2.2.1", [input.resource_id])
}

violation[msg] {
    input.resource_type == "aws_s3_bucket"
    not input.server_side_encryption
    msg := sprintf("S3 bucket %s lacks SSE — violates NIST SC-28", [input.resource_id])
}
```

### AWS Config Rules

```bash
# Enable AWS Config recorder
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::012345678901:role/ConfigRole

# Deploy managed compliance rules
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "encrypted-volumes",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "ENCRYPTED_VOLUMES"
  },
  "Scope": {
    "ComplianceResourceTypes": ["AWS::EC2::Volume"]
  }
}'

# Check compliance status
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name encrypted-volumes \
  --compliance-types NON_COMPLIANT \
  --query 'EvaluationResults[].{Resource:EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,Status:ComplianceType}'

# Aggregate compliance across accounts
aws configservice get-aggregate-compliance-details-by-config-rule \
  --configuration-aggregator-name org-aggregator \
  --config-rule-name encrypted-volumes \
  --compliance-type NON_COMPLIANT
```

### InSpec Scheduled Scans

```bash
# Cron-based InSpec compliance scan
cat > /etc/cron.d/compliance-scan << 'EOF'
0 */4 * * * root inspec exec /opt/compliance/cis-benchmark \
  --reporter json:/var/log/compliance/$(date +\%Y\%m\%d-\%H\%M).json \
  2>> /var/log/compliance/errors.log
EOF

# Parse results for drift detection
jq '[.profiles[].controls[] | select(.results[].status == "failed")] | length' \
  /var/log/compliance/latest.json
```

## Workflow

### Step 1: Initialize Monitoring Pipeline

```bash
node scripts/agent.js --action init --framework cis-aws \
  --output /tmp/ccm-init.json
```

### Step 2: Evaluate Current Compliance State

```bash
node scripts/agent.js --action evaluate --source aws-config \
  --region us-east-1 --output /tmp/ccm-eval.json
```

### Step 3: Generate Drift Report

```bash
node scripts/agent.js --action drift --baseline /tmp/ccm-baseline.json \
  --current /tmp/ccm-eval.json --output /tmp/ccm-drift.json
```

## Verification

- [ ] OPA policies loaded and evaluating against live configuration
- [ ] AWS Config rules deployed for all critical resource types
- [ ] InSpec scans running on schedule with results persisted
- [ ] Drift detection alerts firing within 15 minutes of change
- [ ] Compliance dashboard showing real-time posture score
- [ ] Remediation runbooks linked to each non-compliant finding

## References

- [Open Policy Agent](https://www.openpolicyagent.org/docs/)
- [AWS Config Rules](https://docs.aws.amazon.com/config/latest/developerguide/)
- [Chef InSpec Profiles](https://docs.chef.io/inspec/)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
