Cloud Compliance as Code: SOC 2, HIPAA, PCI

<p>Compliance frameworks like SOC 2, HIPAA, and PCI-DSS are usually treated as a once-a-year fire drill: a spreadsheet of manual checks, screenshots taken right before an auditor arrives, and controls that quietly drift out of shape in between. This project follows a compliance engineer at a healthcare SaaS company racing to land a major hospital contract, and shows how to replace that scramble with compliance as code: policy-as-code rules built with OPA/Conftest and AWS Config that enforce access control, encryption, network restrictions, and log retention, wired directly into CI/CD so non-compliant infrastructure is blocked before it ever merges. You will also see how to keep systems continuously audit-ready with automated evidence collection, how to handle exceptions with documented compensating controls, and how to work with auditors through a live compliance dashboard instead of a folder of screenshots.</p>

Tools: compliance as code, soc 2, hipaa, pci-dss, policy as code, aws config