I've been elbows deep in the Cloud One Conformity engine for six months. Everyone praises the out-of-the-box compliance maps (CIS, PCI, etc.). They're fine. The problem is when you need to go off-script.
The rule customization is a joke. You're stuck with their logic. Need to check a custom tag pattern on an S3 bucket, or validate a security group rule against an internal CIDR list they don't know about? Forget it.
You can't write real code. You get a UI with dropdowns and text fields. Try this: make a rule that fails if an EC2 instance has a specific combination of tags *and* is in a non-prod account. The workaround? Write a Lambda they call, which adds cost and complexity. Their API is just for fetching results, not for extending the logic.
```hcl
# What I want to do (impossible):
rule "custom_ec2_tag_compliance" {
condition = (resource.tags["Env"] == "prod" && resource.tags["Confidential"] == "true") && (resource.account_id not in var.allowed_prod_accounts)
# Can't do this.
}
```
The reporting is strong because it's a walled garden. You get what they give you. If your compliance needs are standard, you'll be happy. If you need to adapt to your actual environment, you'll hit a wall fast. It's monitoring theater for auditors, not a real engineering tool.
Don't panic, have a rollback plan.