Orchestrates IAM, IAM Access Analyzer, and Security Hub findings into an AI-narrated HTML compliance report. EventBridge weekly trigger, S3 output, CloudFormation deployed.

Terraform module enforcing SC-28, AC-3, CM-6, AU-3, AU-6 into every S3 bucket. terraform show -json produces machine-readable evidence an auditor can traverse without a console login.

Reusable Terraform module for GCP Cloud Storage hard-coding six NIST 800-171 controls with plan-time validation gates that reject non-compliant config before any resource reaches GCP.

Ephemeral FedRAMP-realistic GKE cluster. SC-28, CM-6, AC-3, AU-3 hard-coded. Evidence lives in artifacts/terraform-state.json, auditor-traversable without console access. Maps to NIST 800-53, FedRAMP, CMMC L2, SOC 2.

Three OPA Rego policies that validate a Terraform plan against NIST 800-53 SC-28, AC-3, and CM-6 before any resource is deployed. Runs as a pre-apply gate against terraform plan -json output. Each deny message returns the resource address and NIST control ID so developers know exactly what to fix without filing a GRC ticket. Eight tests, three controls, no cloud access needed.

Conftest policy gate that blocks Terraform applies on non-compliant AWS infrastructure by running three Rego policies against plan JSON. Fail-closed, exit-code-driven, zero screenshots. AWS-specific variants of SC-28, AC-3, and CM-6 solve the cross-cloud coverage gap: a GCP policy against an AWS plan passes silently and proves nothing. A policy-gate.sh wrapper captures machine-readable JSON evidence and exits non-zero on any failure.

Extended the CI policy gate with keyless Cosign signing over GitHub OIDC so every evidence bundle is cryptographically tied to the exact CI run that produced it. Object Lock proves evidence can't be deleted. This proves who put it there and when. An auditor verifies the chain independently without trusting the AWS account.