Policy as Code

A wiki page that says "all S3 buckets must be private" prevents nothing — it's read once, if ever, and forgotten by the next person who copies an old module. A policy written as code and evaluated automatically against every plan or admission request prevents the violation from landing at all, regardless of who wrote the change or whether they read the wiki.

The shift this skill is about is from auditing infrastructure after the fact to rejecting bad infrastructure before it's ever applied. An audit finding is a cleanup task; a policy failure is a change that never happened.

A policy that only runs in a nightly audit report is a compliance artifact. A policy that blocks the pipeline is a guardrail. Prefer the guardrail.

For side-by-side Kyverno YAML policies and OPA Gatekeeper Rego constraint templates, read references/kyverno-and-rego.md.

1. Put the check where the change is still reversible