Moeve: Controlling resource deployment at scale with AWS CloudFormation Guard Hooks

Moeve, a global energy company, implemented AWS CloudFormation Guard Hooks to improve resource deployment governance and security across their multi-account AWS environment. The key aspects of their solution include:

• Centralized S3 bucket for storing Guard Hook rules across the organization
• Deployment of hooks using CloudFormation StackSets to multiple accounts
• Custom hooks to validate and enforce security configurations, specifically for API Gateway deployments
• Preventing resource deployments that do not meet security requirements
• Providing clear error messages to help developers quickly address configuration issues

The implementation allows Moeve to balance infrastructure flexibility with robust governance, ensuring secure and consistent cloud resource deployments while maintaining developer autonomy.