Projects - Mark Janowski

Sep 2026
CGE-P Capstone
I inherited a patient intake API that shipped non-compliant on purpose and wrapped it so the same system could stand up to a HIPAA review.
- CGE-P Capstone
- Terraform
- OPA
- AWS
- HIPAA
- OSCAL
- KMS
- Object Lock
- Rego
- Conftest
- GitHub Actions
- Cosign
- CloudTrail
Aug 2026
CGE-P Curriculum
The CGE-P labs in one repo. Infrastructure that comes up compliant, policies that block a bad plan, and a pipeline that keeps the proof.
- GRC Engineering Academy
- Terraform
- OPA
- AWS
- GCP
- NIST 800-53
- KMS
- Object Lock
- Rego
- Conftest
- GitHub Actions
- OIDC
- Cosign
- Sigstore
- CloudTrail
- Security Hub
- Org Policy
- WIF
- OSCAL

Labs

Smaller experiments - a single policy, a script, a proof of concept. Each links straight to its repo.

Aug 2026
AWS Security Services Baseline(opens in a new tab)
Multi-region CloudTrail with log-file validation, and Security Hub on the NIST 800-53 standard, both in Terraform. The first findings come out as JSON.
- CGE-P 5.2
- AU-2
- AU-9
- AU-10
- AU-12
- RA-5
- AWS
- CloudTrail
- Security Hub
Aug 2026
Evidence Management & Chain of Custody(opens in a new tab)
Keyless Cosign signing on the evidence bundle, then one script to check the whole chain.
- CGE-P 4.4
- Cosign
- Sigstore
- AWS
Aug 2026
Building a GRC Evidence Pipeline(opens in a new tab)
The policy gate on every pull request: Terraform plan, Conftest, and a Trivy scan, using short-lived OIDC credentials instead of AWS keys.
- CGE-P 4.3
- SC-28
- AC-3
- CM-6
- GitHub Actions
- OIDC
- Conftest
Aug 2026
Integrating PaC with Terraform(opens in a new tab)
AWS versions of the SC-28, AC-3, and CM-6 policies, plus a Conftest gate that fails the build when a plan violates them.
- CGE-P 3.4
- SC-28
- AC-3
- CM-6
- Conftest
- OPA
- AWS
Aug 2026
Writing Compliance Policies in Rego(opens in a new tab)
Three NIST 800-53 controls as OPA policies. They read a Terraform plan and refuse it before anything is built. Each one has tests.
- CGE-P 3.3
- SC-28
- AC-3
- CM-6
- OPA
- Rego
- GCP
Aug 2026
IaC as Compliance Evidence(opens in a new tab)
A write-once S3 vault with Object Lock, plus a script that snapshots the plan, hashes it, and hands back a signed receipt. The infrastructure is the evidence.
- CGE-P 2.5
- AU-9
- AU-10
- AU-11
- SI-7
- SC-28
- Terraform
- AWS
- Object Lock
Aug 2026
Terraform Modules for Compliance(opens in a new tab)
A Terraform module for a GCS bucket with a customer-managed key, public access blocked, and a retention floor that fails the plan below 365 days in production.
- CGE-P 2.4
- SC-12
- SC-13
- SC-28
- AC-3
- AU-11
- CM-6
- Terraform
- GCP
- KMS
Aug 2026
Building your First Compliant Resource(opens in a new tab)
A Terraform module for an S3 bucket that comes up encrypted, versioned, and locked down, with access logs going to a separate bucket.
- CGE-P 2.3
- SC-28
- AC-3
- AU-3
- AU-6
- CM-6
- Terraform
- AWS
- NIST 800-53