/generate-implementation

description: Generate implementation code for a security control

Generate Implementation

Generates production-ready implementation code for a security control, including:

• Infrastructure as Code (Terraform)
• Automation scripts (Python, Bash)
• Monitoring dashboards
• Evidence collection scripts
• Documentation templates

Usage

/grc-engineer:generate-implementation <control> <cloud-provider> [options]

Arguments

• `$1` - Control ID or name (e.g., "access_control_account_management", "AC-2", "encryption_at_rest")
• `$2` - Cloud provider: `aws`, `azure`, `gcp`, or `kubernetes`
• `$3` - Output directory (optional, defaults to `./generated`)
• `$4` - Options (optional): `--terraform-only`, `--scripts-only`, `--with-tests`

Examples

# Generate full implementation for AWS
/grc-engineer:generate-implementation access_control_account_management aws

# Generate for Azure with specific output directory
/grc-engineer:generate-implementation encryption_at_rest azure ./compliance/encryption

# Generate Terraform only for GCP
/grc-engineer:generate-implementation logging_and_monitoring gcp ./terraform --terraform-only

# Generate with tests for Kubernetes
/grc-engineer:generate-implementation network_security kubernetes ./k8s --with-tests

Output Structure

generated/
├── terraform/
│   ├── main.tf              # Main Terraform configuration
│   ├── variables.tf         # Input variables
│   ├── outputs.tf           # Output values
│   ├── providers.tf         # Provider configuration
│   └── README.md            # Deployment instructions
├── scripts/
│   ├── deploy.sh            # Deployment automation
│   ├── evidence_collect.py  # Evidence collection
│   ├── compliance_test.py   # Compliance testing
│   └── remediate.py         # Automated remediation
├── monitoring/
│   ├── dashboard.json       # CloudWatch/Azure Monitor dashboard
│   └── alerts.yaml          # Alert configurations
└── docs/
    ├── IMPLEMENTATION.md    # Implementation guide
    ├── EVIDENCE.md          # Evidence collection procedures
    └── FRAMEWORKS.md        # Framework mappings

Example Output

Command

/grc-engineer:generate-implementation access_control_account_management aws ./compliance

Generated Files

terraform/main.tf

# Generated for: Access Control - Account Management
# Frameworks: NIST AC-2, ISO A.9.2, SOC2 CC6.1, PCI 8.1
# Cloud Provider: AWS
# Generated: 2025-01-15

# IAM Account Lifecycle Management
module "account_lifecycle" {
  source = "terraform-aws-modules/iam/aws//modules/iam-account"

  # Quarterly access reviews (PCI-DSS requirement)
  access_review_schedule = "rate(90 days)"

  # Automated detection of inactive users (90-day threshold)
  inactive_user_threshold_days = 90

  # Automated user deprovisioning
  auto_disable_inactive_users = true

  # Least privilege enforcement
  default_permissions_boundary = aws_iam_policy.least_privilege.arn

  # Audit logging
  enable_cloudtrail_logging = true
  cloudtrail_retention_days = 365  # 1 year for SOC2/PCI compliance

  tags = {
    Compliance = "SOC2,PCI-DSS,NIST-800-53,ISO-27001"
    Control    = "access_control_account_management"
    ManagedBy  = "Terraform"
  }
}

# IAM Access Analyzer for unused access detection
resource "aws_accessanalyzer_analyzer" "compliance" {
  analyzer_name = "compliance-access-analyzer"
  type          = "ACCOUNT"

  tags = {
    Compliance = "SOC2,NIST-800-53"
    Control    = "AC-2"
  }
}

# EventBridge rule for quarterly access reviews
resource "aws_cloudwatch_event_rule" "access_review" {
  name                = "quarterly-access-review"
  description         = "Trigger quarterly access review (PCI 8.1.4)"
  schedule_expression = "rate(90 days)"

  tags = {
    Compliance = "PCI-DSS"
    Requirement = "8.1.4"
  }
}

resource "aws_cloudwatch_event_target" "access_review" {
  rule      = aws_cloudwatch_event_rule.access_review.name
  target_id = "AccessReviewLambda"
  arn       = aws_lambda_function.access_review.arn
}

# Lambda function for automated access reviews
resource "aws_lambda_function" "access_review" {
  filename      = "access_review.zip"
  function_name = "quarterly-access-review"
  role          = aws_iam_role.lambda_exec.arn
  handler       = "access_review.handler"
  runtime       = "python3.11"
  timeout       = 300

  environment {
    variables = {
      SNS_TOPIC_ARN = aws_sns_topic.compliance_alerts.arn
      INACTIVE_DAYS = "90"
    }
  }

  tags = {
    Compliance = "SOC2,PCI-DSS,NIST-800-53"
  }
}

# SNS topic for compliance notifications
resource "aws_sns_topic" "compliance_alerts" {
  name = "compliance-alerts"

  tags = {
    Purpose = "Compliance notifications"
  }
}

# CloudTrail for audit logging
resource "aws_cloudtrail" "audit" {
  name                          = "compliance-audit-trail"
  s3_bucket_name               = aws_s3_bucket.audit_logs.id
  include_global_service_events = true
  is_multi_region_trail        = true
  enable_log_file_validation   = true

  event_selector {
    read_write_type           = "All"
    include_management_events = true
  }

  tags = {
    Compliance = "NIST-800-53,SOC2,PCI-DSS"
    Control    = "AU-2,AU-3"
  }
}

# S3 bucket for audit logs (1 year retention)
resource "aws_s3_bucket" "audit_logs" {
  bucket = "compliance-audit-logs-${data.aws_caller_identity.current.account_id}"

  tags = {
    Compliance = "PCI-DSS,SOC2"
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "audit_logs" {
  bucket = aws_s3_bucket.audit_logs.id

  rule {
    id     = "retention"
    status = "Enabled"

    # Keep online for 6 months (exceeds PCI 3-month requirement)
    transition {
      days          = 180
      storage_class = "GLACIER"
    }

    # Total retention: 1 year (PCI/SOC2 requirement)
    expiration {
      days = 365
    }
  }
}

# S3 bucket encryption
resource "aws_s3_bucket_server_side_encryption_configuration" "audit_logs" {
  bucket = aws_s3_bucket.audit