---
title: "I Automated the Part of My Job That Was Making Me Quit"
published: false
tags: [devsecops, compliance, python, security]
---
There's a specific kind of dread that hits on a Tuesday afternoon when your Slack lights up with: *"Audit prep starts next week. Can you pull together the evidence package?"*
You know what that means. Three weeks of:
- Digging through CloudTrail logs like an archaeologist
- Exporting CSVs from five different dashboards
- Writing the same "here's what we do for access control" paragraph for the fourth time this year
- Discovering, on day twelve, that one Lambda function has been logging to an unencrypted bucket since March
I've been that engineer. I've also been the one who *caused* that Lambda situation. Neither role is fun.
This is why we built **ComplianceWeave** — continuous infrastructure compliance monitoring that generates audit-ready reports automatically, across SOC2, GDPR, HIPAA, and ISO 27001, without the quarterly fire drill.
---
## The Actual Problem (Not the Sales Version)
Point-in-time audits are a lie we tell ourselves.
You scramble, you clean up, you document, you pass. Then six weeks later someone deploys a new service and forgets to tag it, or a contractor account doesn't get deprovisioned, or MFA enforcement drifts because someone was fighting a production incident and temporarily loosened a policy.
Compliance isn't a state you achieve. It's a state you *maintain*. And maintaining it manually, across multiple frameworks that all care about slightly different things, is a full-time job that nobody actually has time for.
ComplianceWeave treats compliance like you treat uptime: something you monitor continuously, alert on when it breaks, and have runbooks for.
---
## Quick Start
bash
pip install complianceweave
Set your API key and point it at your infrastructure:
python
import complianceweave as cw
client = cw.Client(api_key="cw_live_...")
scan = client.scan(frameworks=["soc2", "gdpr"], target="aws://us-east-1")
print(scan.summary())
That's it. Within minutes you'll have a gap analysis across both frameworks, ranked by severity, with control IDs mapped to the actual resources causing the finding.
No YAML manifests. No agent to deploy. No "contact sales to enable this feature."
---
## Real-World Use Case: Catching Drift Before Your Auditor Does
Here's a pattern I see constantly: a team passes their SOC2 Type II audit in Q1, then spends the rest of the year building features. By Q4, when the next audit window opens, they've accumulated months of compliance drift they don't know about.
Let's say you want to run ComplianceWeave as part of your CI/CD pipeline — not just scanning prod, but catching violations before they ever merge.
python
import complianceweave as cw
import sys
client = cw.Client(api_key="cw_live_...")
Scan a staging environment after infrastructure changes
scan = client.scan(
frameworks=["soc2", "hipaa"],
target="aws://us-west-2",
environment="staging",
severity_threshold="medium"
)
Get auto-generated remediation plans for any findings
if scan.has_violations():
for violation in scan.violations:
print(f"[{violation.severity.upper()}] {violation.control_id}: {violation.title}")
print(f" Resource: {violation.resource_arn}")
print(f" Fix: {violation.remediation.description}")
print(f" Terraform: {violation.remediation.iac_snippet}\n")
# Fail the pipeline if critical violations exist
if scan.critical_count > 0:
print(f"❌ {scan.critical_count} critical violation(s) found. Blocking deploy.")
sys.exit(1)
print(f"✅ Scan complete. {scan.passing_controls}/{scan.total_controls} controls passing.")
**Sample output:**
plaintext
[HIGH] CC6.1: Encryption at rest not enabled
Resource: arn:aws:rds:us-west-2:123456789:db/user-data-staging
Fix: Enable storage encryption on RDS instance. Note: requires snapshot restore for existing instances.
Terraform: storage_encrypted = true
[MEDIUM] GDPR-Art32: Data processing logs retained beyond policy window
Resource: arn:aws:logs:us-west-2:123456789:log-group:/app/user-events
Fix: Set retention policy to 90 days per your DPA.
Terraform: retention_in_days = 90
✅ Scan complete. 47/49 controls passing.
The remediation plans aren't generic advice — they're generated from the actual resource configuration, with IaC snippets you can drop directly into your Terraform. When your auditor asks "how do you ensure encryption at rest?", your answer isn't a doc you wrote last February. It's a dashboard showing continuous enforcement and a git history of remediations.
---
## Multi-Framework, Without the Redundancy
One thing that's genuinely annoying about compliance is that SOC2, HIPAA, and ISO 27001 all care about encryption, access control, and audit logging — they just call them different things and ask for slightly different evidence.
ComplianceWeave maps controls across frameworks automatically. If your S3 bucket encryption satisfies SOC2 CC6.1, we tell you it also satisfies HIPAA §164.312(a)(2)(iv) and ISO 27001 A.10.1.1. You fix it once, it counts everywhere.
python
See which frameworks a single remediation satisfies
violation = scan.violations[0]
print(violation.cross_framework_mappings)
{
"soc2": "CC6.1",
"hipaa": "§164.312(a)(2)(iv)",
"iso27001": "A.10.1.1"
}
For startups navigating their first SOC2 while also trying to land an enterprise customer who wants HIPAA attestation, this is the difference between two parallel workstreams and one.
---
## Generating Audit Reports
When the auditor actually shows up:
python
report = client.generate_report(
framework="soc2",
period_start="2024-01-01",
period_end="2024-12-31",
format="pdf" # or "json", "csv"
)
report.save("soc2_type2_evidence_2024.pdf")
The report includes control status over time (not just current state), evidence timestamps, resource inventory, and a change log of every violation and remediation. It's the audit package, assembled automatically from twelve months of continuous monitoring.
---
## What We're Not
We're not a SIEM. We're not trying to replace your security team's threat detection. We're not a checkbox tool that gives you a passing score while your infrastructure is actually on fire.
ComplianceWeave is infrastructure compliance infrastructure. It's the layer that answers "are we compliant?" continuously, so that question stops being a project and starts being a metric.
---
## Try It
The API is live. The Python client is open source.
- **⭐ Star the client library**: [github.com/complianceweave/complianceweave-python](https://github.com/complianceweave/complianceweave-python)
- **🚀 Start a free scan**: [complianceweave.io/start](https://complianceweave.io/start) — no credit card, scans your first framework free
- **📖 Read the docs**: [docs.complianceweave.io](https://docs.complianceweave.io)
If you've got questions about integrating into your pipeline, or want to talk through a specific framework requirement, drop a comment below. I read all of them.
---
*Built by engineers who have been on both sides of the audit table. We know what auditors actually look for, and we know what "three weeks of evidence collection" does to a team's morale.*
Top comments (0)