policy-as-code

1# Policy as Code
2 
3Automate policy enforcement through code using OPA/Rego, Kyverno, Checkov, and CI/CD integration to prevent compliance violations before they reach production.
4 
5## When to Use
6 
7- Enforcing security and compliance policies on infrastructure-as-code changes
8- Preventing misconfigured Kubernetes workloads from deploying
9- Automating guardrails in CI/CD pipelines for Terraform, CloudFormation, or Helm
10- Implementing organizational standards that must be consistently applied
11- Replacing manual approval gates with automated policy checks
12 
13## Open Policy Agent (OPA) Rego Policies
14 
15```rego
16# deny_public_s3.rego - Deny S3 buckets with public access
17package terraform.aws.s3
18 
19import rego.v1
20 
21deny contains msg if {
22    resource := input.resource_changes[_]
23    resource.type == "aws_s3_bucket"
24    resource.change.after.acl == "public-read"
25    msg := sprintf(
26        "S3 bucket '%s' has public-read ACL. All buckets must be private. [Policy: no-public-s3]",
27        [resource.address]
28    )
29}
30 
31deny contains msg if {
32    resource := input.resource_changes[_]
33    resource.type == "aws_s3_bucket"
34    resource.change.after.acl == "public-read-write"
35    msg := sprintf(
36        "S3 bucket '%s' has public-read-write ACL. This is strictly prohibited. [Policy: no-public-s3]",
37        [resource.address]
38    )
39}
40```
41 
42```rego
43# require_encryption.rego - Require encryption on data stores
44package terraform.aws.encryption
45 
46import rego.v1
47 
48deny contains msg if {
49…