TLDR Tech / InfoSec
Governing Infrastructure as Code Using Pattern-Based Policy as Code
Open Policy Agent (OPA) can be used to enforce organizational patterns in infrastructure-as-code (IaC) workflows using policy-as-code (PaC). This article proposes a workflow where a CI/CD system runs early validation checks, followed by a Terraform plan, followed by OPA checks against the generated plan, and then uploads the validation artifacts for approval decisions. The article includes example workflows that enforce secure transport over S3, restrict public ingress on sensitive ports, and enforce least privilege for IAM roles.
Read the full story