In this guide, we covered the following areas of the developer lifecycle and the AWS services and tools that you can use to ensure that your software and resource deployment comply with your governance requirements.

• Developer tooling (local validation): CloudFormation Guard
• Code repository (pre-commit webhook validation): CloudFormation Guard
• Deployment (pipeline validation): CloudFormation Guard, AWS Config, Signer
• Account (resources deployed): Amazon Inspector, AWS Config
• Observability (for governance monitoring): CloudWatch

A rich open source ecosystem also affords additional options for your governance needs, and we wanted to call out a few tools that we see some of our customers using.

• Open Policy Agent for preventative controls, both at the developer workstations and within the deployment toolchain.
• Cloud Custodian for detective controls, monitoring accounts and resources deployed.
• cfn_nag or cdk-nag for template linting, inspecting templates for patterns that might violate governance policies.
• CfnGuardValidator for integration of CloudFormation Guard with CDK infrastructure as code tooling.