policy-as-code

Policy as Code

A wiki page that says "all S3 buckets must be private" prevents nothing — it's read once, if ever, and forgotten by the next person who copies an old module. A policy written as code and evaluated automatically against every plan or admission request prevents the violation from landing at all, regardless of who wrote the change or whether they read the wiki.

The shift this skill is about is from auditing infrastructure after the fact to rejecting bad infrastructure before it's ever applied. An audit finding is a cleanup task; a policy failure is a change that never happened.

A policy that only runs in a nightly audit report is a compliance artifact. A policy that blocks the pipeline is a guardrail. Prefer the guardrail.

For side-by-side Kyverno YAML policies and OPA Gatekeeper Rego constraint templates, read references/kyverno-and-rego.md.

1. Put the check where the change is still reversible

The cheapest place to reject a bad change is before it's ever applied — evaluate policy against the Terraform plan output or the Kubernetes admission request, not against resources that already exist. By the time a nightly scan finds a public bucket, it's been public for up to a day.

deny[msg] {
  input.resource_changes[_].change.after.acl == "public-read"
  msg := "S3 buckets must not be created with public-read ACL"
}

• Gate the CI pipeline on the policy check, not just the merge review — a human reviewer misses what an automated check catches every time.
• Fail the pipeline, don't just warn, once a policy is trusted — a warning nobody reads has the same effect as no policy.
• Reserve runtime/admission-time enforcement for the things that slip through pre-merge, like changes applied outside the pipeline entirely.

Done when: a plan or manifest violating a written policy cannot be applied through the normal pipeline path, full stop.

2. Start every new policy in audit mode

A brand-new policy enforced immediately as a hard block will, with near certainty, break some legitimate change nobody anticipated when writing the rule — and the first thing anyone learns about the new policy is that it's an obstacle. Ship it as a warning first, watch what it flags against real traffic for a stretch, then flip it to enforcing.