Compliance lifecycle management for cloud-based resources
Methods, systems, and computer-readable media for compliance lifecycle management for cloud-based resources are disclosed. A selection is received of a compliance pack from a plurality of compliance packs. The compliance pack comprises a plurality of rules associated with policy compliance. The compliance pack is selected from the plurality of compliance packs via a user interface. The selection is associated with one or more resources hosted in one or more provider networks. An evaluation is performed of compliance of the one or more resources with respect to the plurality of rules of the compliance pack. Data describing the evaluation is generated and displayed. The data comprises an aggregate compliance status for at least one of the one or more resources, and the aggregate compliance status represents an aggregate compliance with the plurality of rules.
1. A system, comprising:
a package repository storing a plurality of compliance packs including a first compliance pack, wherein the first compliance pack comprises a plurality of rules and indicates one or more remedial actions; and
a compliance management system comprising one or more processors and one or more memories to store computer-executable instructions that, if executed, cause the one or more processors to:
receive a selection of the first compliance pack, wherein the first compliance pack is selected from the plurality of compliance packs via a user interface, wherein the selection is associated with one or more resources hosted in a cloud-based, multi-tenant provider network, and wherein the one or more resources use or access data that are subject to one or more compliance rules;
perform an evaluation of policy compliance of the one or more resources with respect to the plurality of rules of the first compliance pack;
generate and display data describing the evaluation, wherein the data describing the evaluation comprises an aggregate compliance status representing an aggregate compliance with the plurality of rules;
determine, based at least in part on the evaluation, that at least one of the resources fails to comply with one or more of the rules; and
perform one or more of the remedial actions associated with the one or more of the rules, wherein the one or more of the remedial actions modify a configuration of the at least one of the resources that fail to comply with the one or more of the rules.
2. The system as recited in claim 1 , wherein the one or more memories store additional computer-executable instructions that, if executed, cause the one or more processors to:
perform additional evaluations of the compliance of the one or more resources with respect to the plurality of rules of the first compliance pack, wherein the additional evaluations are performed according to a schedule described in the first compliance pack; and
generate and display updated data describing the additional evaluations, wherein the updated data describing the additional evaluations comprises one or more updated aggregate compliance statuses.
3. The system as recited in claim 1 , wherein the first compliance pack is customized according to user input based at least in part on one or more predefined compliance packs, wherein one or more customizations in the first compliance pack represent an inclusion or exclusion of one or more rules in the one or more predefined compliance packs, and wherein the one or more memories store additional computer-executable instructions that, if executed, cause the one or more processors to:
publish the first compliance pack to a compliance pack marketplace, wherein the plurality of compliance packs are listed and described in the compliance pack marketplace, and wherein the user interface is associated with the compliance pack marketplace.
4. The system as recited in claim 1 , wherein the first compliance pack is selected based at least in part on input from a user account, wherein the user account comprises a master account having access privileges to a plurality of resources of an enterprise, and wherein the first compliance pack is deployed to the plurality of resources of the enterprise.
5. A method, comprising:
receiving a selection of a compliance pack from a plurality of compliance packs, wherein the compliance pack comprises a plurality of rules associated with policy compliance, wherein the compliance pack is selected from the plurality of compliance packs, and wherein the selection is associated with one or more resources hosted in one or more provider networks, and wherein the one or more resources use or access data that are subject to one or more compliance rules;
performing an evaluation of compliance of the one or more resources with respect to the plurality of rules of the compliance pack; and
generating and displaying data describing the evaluation, wherein the data describing the evaluation comprises an aggregate compliance status for at least one of the one or more resources, wherein the aggregate compliance status represents an aggregate compliance with the plurality of rules.
6. The method as recited in claim 5 , further comprising:
determining, based at least in part on the evaluation, that at least one of the resources fails to comply with one or more of the rules; and
performing one or more automated remedial actions described in the compliance pack, wherein the one or more automated remedial actions comprise modifying a configuration of the at least one of the resources that fail to comply with the one or more of the rules.
7. The method as recited in claim 5 , further comprising:
performing additional evaluations of the compliance of the one or more resources with respect to the plurality of rules of the compliance pack, wherein the additional evaluations are performed according to a schedule described in the compliance pack; and
generating and displaying updated data describing the additional evaluations, wherein the updated data describing the additional evaluations comprises one or more updated aggregate compliance statuses.
8. The method as recited in claim 5 , wherein the compliance pack is customized according to user input based at least in part on one or more predefined compliance packs, wherein one or more customizations in the compliance pack represent an inclusion or exclusion of one or more rules in the one or more predefined compliance packs.
9. The method as recited in claim 8 , further comprising:
publishing the compliance pack to a compliance pack marketplace, wherein the plurality of compliance packs are listed and described in the compliance pack marketplace, wherein the user interface is associated with the compliance pack marketplace.
10. The method as recited in claim 5 , wherein the compliance pack is selected based at least in part on input from a user account, wherein the user account comprises a master account having access privileges to a plurality of resources of an enterprise, and wherein the compliance pack is deployed to the plurality of resources of the enterprise.
11. The method as recited in claim 5 , wherein the plurality of compliance packs are defined according to a common model.
12. The method as recited in claim 5 , wherein the one or more provider networks comprise a cloud-based, multi-tenant provider network hosting a plurality of resources on behalf of a plurality of clients, and wherein the multi-tenant provider network comprises a plurality of services that collaborate to host the plurality of resources.
13. One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more processors, perform:
receiving a selection of a compliance pack from a plurality of compliance packs, wherein the compliance pack comprises a plurality of rules associated with policy compliance and one or more remedial actions, wherein the compliance pack is selected from the plurality of compliance packs via a user interface, wherein the selection is associated with one or more resources hosted in one or more cloud-based provider networks, and wherein the one or more resources use or access data that are subject to one or more compliance rules;
performing an evaluation of compliance of the one or more resources with respect to the plurality of rules of the compliance pack;
generating and displaying data describing the evaluation, wherein the data describing the evaluation comprises an aggregate compliance status for at least one of the one or more resources, wherein the aggregate compliance status represents an aggregate compliance with the plurality of rules;
determining, based at least in part on the evaluation, that at least one of the resources fails to comply with one or more of the rules; and
performing one or more automated remedial actions described in the compliance pack, wherein the one or more automated remedial actions place the at least one of the resources in compliance with the plurality of rules of the compliance pack.
14. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the one or more automated remedial actions comprise modifying a configuration of the at least one of the resources that fail to comply with the one or more of the rules.
15. The one or more non-transitory computer-readable storage media as recited in claim 13 , further comprising additional program instructions that, when executed on or across the one or more processors, perform:
performing additional evaluations of the compliance of the one or more resources with respect to the plurality of rules of the compliance pack, wherein the additional evaluations are performed according to a schedule described in the compliance pack; and
generating and displaying updated data describing the additional evaluations, wherein the updated data describing the additional evaluations comprises one or more updated aggregate compliance statuses.
16. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the compliance pack is customized according to user input based at least in part on one or more template compliance packs.
17. The one or more non-transitory computer-readable storage media as recited in claim 16 , further comprising additional program instructions that, when executed on or across the one or more processors, perform:
publishing the compliance pack to a compliance pack marketplace, wherein the plurality of compliance packs are listed and described in the compliance pack marketplace, wherein the user interface is associated with the compliance pack marketplace.
18. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the compliance pack is selected based at least in part on input from a user account, wherein the user account comprises a master account having access privileges to a plurality of resources of an enterprise, and wherein the compliance pack is deployed to the plurality of resources of the enterprise.
19. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the plurality of compliance packs are defined according to a common model.
20. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the one or more cloud-based provider networks comprise a multi-tenant provider network hosting a plurality of resources on behalf of a plurality of clients, and wherein the multi-tenant provider network comprises a plurality of services that collaborate to host the plurality of resources.