Recipe 04 · Choose your ingredients
Python + FastAPI
For evidence collection, repeatable checks, and automation.
Learn by building: Open the guided GRC project lesson for this stack.
Each recipe uses the same learning path: understand the ingredients, follow one realistic example, build a small first version, test failure cases, then decide whether to add more. You do not need every ingredient on day one.
All five recipes · Jump to a recipe
When to choose this
What problem does it solve?
A script or service that reads permitted cloud data, applies a documented rule, and produces evidence for human review.
Try the simpler option first: A spreadsheet export or one Python script may be the right first version.
New to the terminology? Start with What Is a Technology Stack? or follow the browser-to-server diagram.
Under the hood
Meet the ingredients
None for a scheduled script; add a simple page or React UI only if people need one
Python scripts; FastAPI when a real HTTP API is needed
Local files or SQLite for a prototype; PostgreSQL or object storage as requirements grow
GitHub
Why it works with AI-assisted coding: Python libraries and cloud SDKs make it practical to inspect one operation at a time. AI can explain API responses and help generate test fixtures.
See the stack in action
One project, from input to result
Goal: Run a repeatable evidence check
A fictional JSON record describing a storage encryption setting
Python applies one documented rule; FastAPI is optional if other systems need an endpoint
A JSON or CSV report with Pass, Fail, or Unknown and a reason
Your first working milestone
One function tested with compliant, noncompliant, and missing-data fixtures
Each sample returns its expected result and explanation
Missing data never becomes a false Pass; file and API errors are visible
Only then consider: Connect read-only cloud APIs only after local tests work; add FastAPI only if needed
Three GRC ideas
What could you build?
- AWS configuration evidence collector using permitted read-only APIs
- Automated control check with documented pass/fail criteria
- Compliance evidence report generator from fictional inputs
Your first version
Build a little, test a little
- Start with a Python script reading synthetic evidence from a local file.
- Define the check, expected output, and what happens when data is missing.
- Replace the fixture with a read-only cloud API call in a properly authorized test account.
- Schedule the script only after logging, credential handling, and failure alerts work. Add FastAPI only if another system needs an endpoint.
Where it runs: Run locally during learning. For scheduled production jobs, evaluate AWS Lambda, a managed container, or another scheduled runtime. Hosting a FastAPI service requires an API-capable runtime; a script alone does not.
Ask AI, then decide
A prompt worth trying
I want a small Python evidence collector. First show a version using fictional JSON. Define success, failure, and missing-data behavior. Explain whether I need FastAPI, a database, or just a scheduled script.
Review the recommendation against your Playbook blueprint. Ask what can be removed, what could go wrong, and how you will test it.