Parent/child first. Evidence emission second. Ansible control plane third.
Every release was a manual evidence collection exercise. The pipeline was the bottleneck.
This is a redacted write-up of a real engagement: rebuilding a healthcare SaaS company's CI/CD pipeline across a fleet of Linux hosts on AWS.
The context
The engineering team had grown faster than the pipeline architecture had evolved. What started as a single-stage GitLab job for a small team had been extended, patched, and worked around as the team scaled past the patterns the original pipeline was built for.
The result was familiar. Each deploy took 30 to 45 minutes of mostly-serial execution. Engineers had developed informal habits to work around the slowness, including pushing partial changes outside the pipeline when the timeline got tight. Audit windows were preceded by three-week sprints in which the team manually compiled deployment logs, screenshots of access reviews, and approval chains into PDFs describing what the pipeline was supposed to be doing.
The work was technically passing HIPAA audits, but the audit was a snapshot of a system the auditor could not independently verify. The cost was paid twice: the velocity loss on every deploy, and the three-week scramble before each assessment. The team knew the architecture was wrong. They needed engineering hands to redesign it without slowing the product roadmap the audits were already eating into.
The approach
The redesign moved in three layers. First, decompose the monolithic pipeline into parent/child stages so work can parallelize and the audit boundary of each stage is provable. Second, build structured evidence emission into every stage as a property of how it runs, not an after-the-fact compilation task. Third, layer an Ansible control plane across the host fleet so HIPAA control state is continuously validated, not reviewed quarterly.
┌────────────────────────── Parent Pipeline (.gitlab-ci.yml) ──────────────────────────┐
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ Validate │──▶│ Build │──▶│ Security │──▶│ Deploy │ │
│ │ (child) │ │ (child) │ │ (child) │ │ (child) │ │
│ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ Lint/Test SBOM + Sign SAST/DAST/ Ansible Apply + │
│ Policy gate Artifact promo Container scan Control validation │
│ Evidence: ✓ Evidence: ✓ Evidence: ✓ Evidence: ✓ │
│ │
└─────────────────────┬────────────────────────────────────────────────────────────────┘
│
▼
┌──────────────────────────────────┐
│ Centralized Evidence Stream │
│ S3 + Object Lock (7yr) │
│ Signed, structured, queryable │
│ Audit query interface (Athena) │
└──────────────────────────────────┘
┃ Ansible Control Plane ┃
┃ ┃
┌─────────────┴──────────┐ ┌─────────┴────────────┐
│ HIPAA Control Roles │ │ Continuous Validation│
│ Encryption · Auth │ │ 32+ hosts · Daily │
│ Audit log · Patching │ │ Drift → Evidence │
└────────────────────────┘ └──────────────────────┘
Key decisions
-
Parent/child pipeline decomposition. The monolithic
.gitlab-ci.ymlwas decomposed into a parent pipeline orchestrating four children: Validate, Build, Security, and Deploy. Each child has explicit inputs, outputs, and audit boundaries. The parent runs in under 60 seconds. Children execute in parallel where dependencies allow, serially where the audit chain requires it. - Evidence emission as a pipeline property. Every stage emits structured JSON to a centralized bucket with S3 Object Lock retention configured for 7 years. Each emission is signed and includes the commit SHA, the runner identity, the policy decisions made during that stage, and the artifacts produced. Auditors query evidence directly via Athena instead of receiving PDFs.
- Ansible-driven HIPAA control validation. 32+ production hosts brought under a single Ansible control plane. Roles encode HIPAA Security Rule technical safeguards: encryption-at-rest verification, audit log shipping to the SIEM, MFA enforcement on privileged accounts, patch level validation, and TLS configuration checks. The control plane runs daily, not quarterly.
- Signed artifact promotion. Images are built once in the Build stage, signed with the pipeline's signing key, and promoted across environments via signature verification. The same artifact that passes the security gate is the artifact that reaches production. The audit chain is cryptographic, not procedural.
- Policy gates at plan time. OPA policies evaluated during Validate reject non-HIPAA-aligned configurations before any infrastructure is touched. Non-encrypted volumes, public IPs on PHI-handling subnets, and untagged resources fail at plan time with structured error output captured as evidence.
- Drift as a build failure. Daily Ansible runs that detect configuration drift emit drift evidence to the same bucket. Drift events trigger pipeline failures the next time the affected service deploys. Drift is treated as a build failure, not a notification engineers learn to ignore.
- SIEM integration read-only. The evidence bucket is the source of truth. Splunk integrates read-only via cross-account IAM. Engineers cannot alter evidence after emission, so the stream survives the audit because there is no point at which a human could have tampered with it.
What we built
Every artifact ships with documentation written for the engineer who would inherit it, not the auditor who would review it.
Multi-stage GitLab pipeline. Parent orchestrating four children with explicit audit boundaries. Total execution dropped from 30 to 45 minutes down to under 10 minutes for typical deploys. Failure isolation is per-stage rather than per-pipeline.
Ansible control role library. Roles covering HIPAA Security Rule technical safeguards across the 32+ hosts. Each role ships a control narrative mapping the Ansible tasks to the specific § 164.312 controls they satisfy. The plane runs daily and emits drift evidence on every divergence.
Centralized evidence pipeline. S3 bucket with 7-year Object Lock. Structured JSON from every pipeline stage, every Ansible run, every policy decision. Athena query interface. SIEM read-only via cross-account IAM.
Signed artifact promotion model. Images built once, signed with a key in AWS KMS, promoted via signature verification. Notary v2 and Cosign as the signing layer. Admission controllers reject any image without a valid signature.
Audit query interface. Athena-backed queries answering the questions auditors ask: who deployed what to which environment, what policy decisions were made on each commit, which hosts were out of compliance on a given date. Questions that used to take three weeks now resolve in under 30 seconds.
"The pipeline rebuild changed how we think about audits. Evidence is now a side effect of normal operations instead of something we manually assemble before each assessment. The next audit was the first one where we didn't have to schedule a dedicated three-week sprint."
Healthcare SaaS, Engineering Lead
Results
| Outcome | |
|---|---|
| 70% | deployment time reduction after the parent/child rebuild |
| 32+ | hosts under continuous HIPAA control validation |
| 7 yr | evidence retention with cryptographic integrity |
The first audit cycle after the rebuild required no dedicated reconstruction sprint. Auditors received query access to the evidence stream instead of a binder of screenshots. Deployment frequency increased, and the off-pipeline workarounds the original architecture had encouraged stopped being necessary.
What made it work
Decomposing the pipeline before optimizing it. The fastest pipeline is the one that does less work. Trying to speed up the monolith would have produced a 20% improvement. Decomposing it produced 70%, with audit-boundary improvements as a side effect.
Evidence as a pipeline property, not a deliverable. Every stage emits evidence the moment it runs, so the cost is amortized into normal operation. The alternative treats evidence as something engineers assemble at audit time, a recurring three-week tax every cycle, every year. The architectural choice was a one-time cost.
Ansible as the control plane, not the deploy tool. The same roles produce the same evidence stream whether they run as part of a deploy or as part of the daily control validation. The code that puts the system into the desired state is the code that verifies it is in the desired state. There is no gap between the deploy tool and the audit tool.
Originally published at stonebridgetechsolutions.com.
Stonebridge Tech Solutions builds compliance-grade cloud infrastructure for healthcare and defense teams. If you want a rough read on your own control count and first-cycle audit cost, the scope estimator takes about two minutes.
Top comments (0)