Re:I Stopped Using Kubernetes. Our DevOps Team Is Happier Th...
by _hl_ on Thursday November 28, 2024 @03:05AM
(#42263467)
The frustrating thing with SOC2, or pretty much most compliance requirements, is that they are less about what’s “technically true”, and more about minimizing raised eyebrows.
It does make some sense though. People are not perfect, especially in large organizations, so there is value in just following the masses rather than doing everything your own way.
Re:I Stopped Using Kubernetes. Our DevOps Team Is Happier Th...
by withinboredom on Thursday November 28, 2024 @03:13AM
(#42263512)
Yes. But it also isn’t a regulation. It is pretty much whatever you say it is.
Re:I Stopped Using Kubernetes. Our DevOps Team Is Happier Th...
by bigfatkitten on Monday December 02, 2024 @03:21PM
(#42300017)
The problem is you need to be able to convince the auditor that your controls meet the requirement. That's a much easier discussion to have with robust logical or physical separation.
Re:I Stopped Using Kubernetes. Our DevOps Team Is Happier Th...
by bigfatkitten on Monday December 02, 2024 @03:19PM
(#42299992)
> And if you are using different accounts there
Which for separating dev and prod, you absolutely should be.
(Separate accounts for AWS; separate projects would suffice for GCP.)
If you say they share the same control plane is commingling… then what do you think a cloud console is? And if you are using different accounts there… then I hope you are using dedicated resources for absolutely everything in prod (can’t imagine what you’d pay for dedicated s3, sqs) because god forbid those two accounts end up on the same machine. Heh, you are probably violating compliance and didn’t even know it!
Sigh. I digress.