this is interesting. i see you've added functionality to use these via a browser. have you considered making these tools available via a cli interface too?
Logged in specifically to agree and upvote this comment!
- on-demand preview of changes before i hit save
- source code is always embedded with the diagram and anyone can reference and edit
- source controlled history via confluence history
I've used mermaid extensively but ultimately abandoned it because it didn't have a good flow for sharing the source and history. Confluence + PlantUML is a great solution.
For too long information security has been a blocker instead of an accelerator. My nightmare scenario was a few years ago when we had to halt all production work for 6 months while we met with endless lawyers and CPAs to try and explain how our entire infrastructure was built. Developers hated it, product hated it, marketing hated it, maybe the CPAs loved it?
I've seen huge deals fall through because of failing to get compliance fast enough, or basic security missteps (how many articles about turning on MFA do we need?) lead to major incidents. And don't even get me started on consultants and spreadsheets. I have stories to share...
That is why we built Control - to solve compliance with one integration.
Controls accelerates and automates SOC2, ISO 27001, PCI and more - so that you can build your company, not work on compliance. No more legalese, writing policies or manually running endless compliance scanners across your systems.
At VGS, we're on a much bigger mission - to protect the world's information. This means that we are relentlessly committed to real security and fast compliance.
That's why as a part of this launch, we're offering guaranteed SOC2 compliance on Control for FREE. Just create an account, commit to real security, and we'll take care of the rest.
As a cloud ops minded person, we thought it would be compelling to allow people to simply connect AWS to a free read only tool, from a company I can trust with our info like VGS, just to see what security results came back.
We'd love to hear your feedback, and if you have questions about Security/Compliance, let us know. My team and I will be around all day to help.
It would be really interesting to hear you talk about how you test the policies that are written for opa.
are the policy documents stored alongside the service or kept in a central registry? do you need to include opa when doing unit testing for the individual services or can it just be layered on and integration tested?