Policy as Code

Automate policy enforcement through code using OPA/Rego, Kyverno, Checkov, and CI/CD integration to prevent compliance violations before they reach production.

Enforcement contract

Examples cover selected controls, not full compliance. Terraform plan JSON can contain secrets: restrict artifact permissions/retention and never upload it as a public artifact. Planning runs providers/data sources and needs approved account scope; do not run untrusted PR configuration with production credentials. opa eval normally exits successfully even when deny contains findings; use a reviewed aggregate decision or Conftest with all namespaces and fail on parse, missing input, unknown values and missing required policy bundles. Resolve the provider version/schema first: ACLs, encryption and tags use different resources. The S3 versioning resource check cannot detect a bucket with no versioning resource; add a graph relationship check. Kyverno examples require compatible CRDs, audit rollout, full container/init/ephemeral coverage and separate digest/signature verification: banning latest does not make another mutable tag trustworthy.