Hey everyone, I've been trying to use ServiceNow GRC to automate security checks across our AWS and Azure accounts. We have about 30 cloud accounts, and doing manual control tests was taking forever.
I set up integration with the cloud providers to pull config data. The good part is having all the findings in one dashboard now. But I struggled a lot with writing the actual test logic for custom controls. The out-of-the-box ones are okay, but our specific policies needed custom scripts, and that wasn't as beginner-friendly as I hoped. 😅
Has anyone else automated cloud control testing with GRC? I'm looking for tips on managing tests at scale, or maybe some step-by-step guides you found useful. Also curious if the cost for the automation modules felt worth it compared to building something simpler in-house with Terraform checks.