Curious if anyone here is working on SaaS workloads with a roadmap for specific compliance frameworks or industry standards? I'm interested in what tools you used, early stage free tools like ones BoxyHQ has on their awesome-oss-devsec page (thanks @Sama), any of the compliance as a service provides (Drata, Vanta, etc.)

I used Prowler.pro service. It has its problems, but it was easy to get started and detected a bunch of issues.

We do use sysdig Secure!

@Bill Tarr I was looking at Drata and it looks interesting for our use case. Right now, we are pretty much managing manually and with various AWS services.

thanks @atechiethought!

what I loved is no-friction approach to onboarding user and aws-compliance mod was pretty easy to install and run. Also, the documentation is great.