Hey everyone, I hope it's okay to jump in with a question that's been bugging me. I've been trying to learn more about modern data stack security, and Aqua Security keeps coming up as a leader. But from what I'm reading... it seems like a lot?
At my place, we're a small team just starting to build our pipelines (mostly Airflow and dbt pointing to BigQuery). We're finally getting a handle on basic access controls and IAM roles. I looked into Aqua because we had a scare with a misconfigured service account, and everyone says "shift left" and container security.
But honestly, the feature list is overwhelming. Runtime protection, CI/CD scans, vulnerability management, CSPM... it feels like we'd need a dedicated security engineer just to configure and tune it. The diagrams have so many components!
Is my feeling off base? For those of you in startups or small data teams, have you actually implemented Aqua successfully without it becoming a full-time job? I'm worried we'd spend more time managing the security tool than actually improving our data products.
Maybe we just need something simpler for now? I'm curious what others think.