Enforcing Compliance at Runtime with Infrastructure and Applications

Runtime Compliance Enforcement Tools and Policy Examples

Falco (Linux Syscall Monitoring)
Falco intercepts and analyzes Linux system calls to detect suspicious activities, such as privilege escalation or unauthorized process execution. Example policies include:

- rule: Container Privilege Escalation
desc: Detect when a container drops privileges but later reacquires them.
condition: > (evt.type=execve and container and container.info!=host and
proc.name=bash and proc.ppid=1 and proc.cmdline contains "--privileged")
output: > Container privilege escalation detected (user=%user.name command=%proc.cmdline)
priority: WARNING
tags: [containers, privilege-escalation]

Use Case: Prevents containers from bypassing security contexts (e.g., `--privileged` flags) after initial deployment.

- Sensitive File Access:

- rule: Access to /etc/shadow
desc: Block attempts to read or modify sensitive system files.
condition: > (evt.type=open and fd.name="/etc/shadow" and proc.name!="passwd")
output: > Unauthorized access to /etc/shadow (user=%user.name process=%proc.name)
priority: CRITICAL
tags: [filesystem, sensitive-data]

Aqua Security (Container and Host Runtime Security)
Aqua Security enforces compliance for containers and VMs by analyzing runtime behavior against predefined policies. Example policies:

rule: "Block Unverified Container Images"
condition: > (image.repository not in ["trusted-registry.example.com/*"] and
container.action=start)
action: "deny"
severity: "high"

Use Case: Ensures only images from approved registries (e.g., private repositories) are executed.

- Root Shell in Containers:

rule: "Detect Root Shell Sessions"
condition: > (container.process.name="sh" or container.process.name="bash" and
container.process.user=root and container.process.args contains "-i")
action: "alert"
severity: "critical"

Use Case: Identifies interactive root shells, which violate least-privilege principles.

Prisma Cloud (Cloud-Native Runtime Security)
Prisma Cloud monitors cloud workloads (e.g., AWS ECS, Azure AKS) for compliance drift. Example policies:

rule: "Kubernetes API Server Accessibility"
condition: > (kubernetes.cluster.api_server.publicly_accessible=true)
action: "block"
severity: "high"

Use Case: Enforces that Kubernetes API servers are not exposed to the internet, reducing attack vectors.

- Unrestricted IAM Roles in Serverless:

rule: "Lambda Function with Wildcard IAM Permissions"
condition: > (aws.lambda.function.iam_role.permissions contains "*")
action: "alert"
severity: "critical"

Use Case: Flags AWS Lambda functions using overly permissive IAM roles (e.g., `*` in resource ARNs).

Integrating Compliance Checks in Serverless Architectures

Workflow for Serverless Compliance Validation
1. Pre-Deployment Checks:

# AWS IAM Policy for Lambda (Least Privilege)
Version: "2012-10-17"
Statement:

Tool*: AWS IAM Policy Simulator to test permissions against compliance rules.

- VPC and Network Compliance: Ensure Lambda functions reside in private subnets with no public endpoints. Use AWS Config Rules or Azure Policy to enforce:

{
"effect": "deny",
"properties": {
"allowedVpcSubnetIds": ["subnet-12345678"]
}
}

2. Runtime Enforcement:

# AWS Lambda Event Source Mapping Check (Python)
import boto3
client = boto3.client('lambda')
response = client.get_event_source_mapping(FunctionName='compliant-function')
if 'EventSourceArn' in response and 'sqs:' not in response['EventSourceArn']:
raise ComplianceException("Unapproved event source detected")

- Custom Runtime Policies: Use AWS Lambda Layers or Azure Functions Extensions to inject compliance checks. Example:

// Node.js Lambda Compliance Layer
exports.handler = async (event, context) => {
const complianceRules = require('./compliance-rules');
if (!complianceRules.validate(event)) {
throw new Error("Compliance violation: " + complianceRules.getViolation(event));
}
// Proceed with function logic
};

3. Post-Execution Auditing:

-- AWS CloudTrail Query for Unauthorized Lambda Invocations
SELECT eventName, requestParameters
FROM cloudtrail_logs
WHERE eventName = 'InvokeFunction'
AND userAgent NOT LIKE '%compliant-service%'

Kubernetes Admission Webhooks for Pre-Pod Compliance Validation

Designing a ValidatingAdmissionWebhook
1. Webhook Service Architecture:

apiVersion: apps/v1
kind: Deployment
metadata:
name: compliance-webhook
spec:
replicas: 2
template:
spec:
containers:

2. Policy Validation Logic:

# Policy: Block Pods with Privileged SecurityContext
package kubernetes.admission
default allow = false
allow {
input.request.kind.kind == "Pod"
not input.request.object.spec.securityContext.privileged
}

- Deploy the policy as a ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
name: compliance-policies
data:
main.rego: |

Implementing Compliance as Code is not merely a technical exercise but a transformative approach to embedding security and governance into every phase of the development lifecycle. By leveraging policy-as-code methodologies, organizations can shift from periodic audits to continuous compliance, where violations are identified and addressed in real-time. The integration of tools like Open Policy Agent, Kyverno, and runtime monitoring solutions ensures that infrastructure remains aligned with regulatory requirements while minimizing manual overhead. As teams adopt these practices, they unlock the potential for faster deployments, reduced compliance risks, and a more agile security posture. The future of compliance lies in automation, and mastering Compliance as Code is the key to achieving it effectively.

• automated compliance
• compliance as code
• devops security
• infrastructure as code
• policy as code