HIPAA Compliance-as-Code Capstone
Patient Intake API — CGE-P Project
Compliance requirements → machine-readable policies → automated validation → signed evidence.
The Problem
A deliberately non-compliant “Acme Health” patient intake API inherited every HIPAA gap you’d expect: PHI on AWS-default keys, no TLS enforcement, missing versioning, wildcard IAM, no API logging. The kind of workload that cannot survive an audit without GRC engineering wrapped around it.
The Approach
↓
Gap Analysis (8 identified gaps, 6 closed)
↓
Terraform Baseline + OPA/Rego Policies (6 policies, 12/12 tests)
↓
Conftest CI Gate (fail-closed on policy violations)
↓
Cosign Keyless Signing → S3 Object Lock Evidence Vault
↓
OSCAL Component Definition (control → code → evidence mapping)
Architecture
- Workload: VPC, Lambda, API Gateway, DynamoDB, S3 patient intake API
- IaC: Terraform baseline with customer-managed KMS, Object Lock evidence vault, multi-region CloudTrail
- Policy: 6 OPA/Rego policies (GAP-01/02/03/04/07/08) with
opa test— 12/12 passing - CI: GitHub Actions with AWS OIDC — plan → Conftest gate → apply on pass
- Evidence: Cosign v2.2.4 keyless signing to immutable S3 bucket
- Mapping: OSCAL component validated by compliance-trestle
GAP-05 (Lambda VPC) and GAP-06 (resilience) remain planned in the OSCAL component.
Enforcement
Two-PR demonstration: green PR merged successfully; red PR reintroducing GAP-01/03/04 was blocked by the Conftest gate. The pipeline is fail-closed—policy violations stop deployment, not just warn.
Evidence
Every pipeline run produces a Cosign-signed evidence bundle stored in an S3 Object Lock vault (cgep-lab-grc-evidence-vault-37bf1d7e). Signing runs even on failing gates—failed runs are evidence too. Verify with cosign verify-blob or the companion cgep-labs verification script.
Engineering Lesson: When compliance evidence becomes a security problem
What happened: During an early CI run, a live AWS access key appeared in a committed terraform/plan.json artifact. Secrets detection flagged it, but the key persisted in a PR ref.
How it was identified: gitleaks and TruffleHog (--only-verified) detected the exposed credential in plan output.
What was remediated: Key rotated and deleted within an hour. Plan artifacts purged, gitignored, and repo rebuilt clean. Post-remediation scan: zero findings.
What was strengthened: Plan artifacts excluded from version control. Added drift detection (monitoring.tf) with EventBridge + Lambda auto-remediation for configuration drift.
Governance lesson: Compliance evidence is itself a security-sensitive artifact. The pipeline that generates audit proof must not become the attack surface.
Lessons Learned
- Fail-closed gates matter—a warning-only policy check is not enforcement.
- OSCAL control-to-code mapping makes audit conversations concrete: “here is the Terraform resource, here is the policy, here is the evidence link.”
- Evidence vaults need Object Lock—mutable storage defeats the purpose of signed artifacts.
- Plan artifacts are secrets vectors; treat CI output with the same care as application code.
- Demonstrating a blocked PR is more convincing to hiring managers than any compliance score.