Governing infrastructure as code using pattern-based policy as code

This article explains how to use Open Policy Agent (OPA) to enforce security and compliance requirements in infrastructure-as-code through pattern-based policy checks in CI/CD pipelines.

• Organize policies around five recurring control patterns: required metadata, allowed configuration, exposure restriction, protection enforcement, privilege constraint
• OPA validates Terraform plans before deployment; AWS services enforce guardrails post-deployment
• Integrate policy evaluation into CI/CD: validate, plan, evaluate policy, publish artifact, approve, deploy
• Structure policy libraries by control domain for easier review, maintenance, and team communication
• Three practical examples: enforce S3 secure transport, restrict public ingress on sensitive ports, enforce least-privilege IAM trust policies
• Retain validation artifacts for approval decisions and audit support
• Test policies like software with positive/negative cases, regression coverage, realistic fixtures
• Phased rollout: advisory mode, enforce high-confidence patterns, operationalize and expand coverage

Pattern-based policy as code helps organizations translate control intent into preventive checks that scale across teams and repositories, reducing security gaps and audit effort.