GxP Compliance Automation
Publication date: May 6, 2021 (Diagram history)
With this architecture, you can build a secure and compliant Good Practice (GxP) workload on AWS. The solution uses Service Catalog to publish approved infrastructure templates, AWS CloudFormation to provision resources, and AWS Config to monitor compliance continuously.
GxP compliance automation diagram
The following steps describe the data flow and compliance automation for this architecture:
-
Use AWS Landing Zone to automate the setup of a secure and scalable environment. The security administrator defines an Service Catalog product (for example, a GxP application) by using CloudFormation templates.
-
Publish the template for developers in Service Catalog. Developers use this framework to further enhance the template based on application requirements.
-
Modify applications under source control by using AWS CodeCommit to manage the private code repository.
-
Deploy the modified code from AWS CodeCommit to your GxP infrastructure. Use Service Catalog Catalog to launch the product as a CloudFormation stack.
-
The stack provisions the necessary AWS resources based on what you committed to the code repository.
-
With Service Catalog at the center of this architecture, you can release source code without needing access to underlying resources or going through security administrators.
-
Automate the testing and installation qualification process by using AWS Lambda or Python. Create a test summary and qualification report automatically in an Amazon S3 bucket.
-
Aggregate all individual AWS CloudTrail logs, Amazon VPC flow logs, and AWS Config changes into a centralized Amazon Simple Storage Service bucket in a separate AWS account.
-
Configure, monitor, and set up automated alerts on changes and on the health of the stack by using Amazon CloudWatch.
-
Record and track change events through AWS Config when the stack changes. Display out-of-compliance events in a dashboard.
-
Initiate CloudWatch alarms based on rules you design to indicate when something might be out of compliance.
-
Use AWS CloudTrail to monitor API calls made against your AWS environment. CloudWatch Events alerts the administrator when something changes that could cause the system to be non-compliant.
-
Query log data and convert it into a human-readable format like CSV by using Amazon Athena for audit purposes.
-
Visualize AWS CloudTrail logs by using AWS Quick Sight.
Further reading
For additional information, see the following resources:
Diagram history
To receive updates about this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Initial publication | Reference architecture diagram first published. | May 6, 2021 |
RSS subscription requirement
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
