🛡️ Continuous Enforcement of Security Policies and Rules in IaC
🌟 Objective
Ensure that all Infrastructure as Code (IaC) projects meet minimum security requirements in an automatic, consistent and verifiable way, through policy enforcement mechanisms integrated into the development and operations lifecycle.
This file defines how policies are applied technically, not which policies they are - that definition takes place in the requirements and in organisational policies.
Enforcement is a structural defence mechanism: when it fails, the organisation depends solely on human discipline.
🔖 What must be done
- Define formal organisational policies applicable to IaC (security, identity, network, data);
- Translate those policies into executable and testable rules (policy-as-code);
- Integrate enforcement in a blocking way into the CI/CD pipelines (pre-merge, pre-apply);
- Centralise the rules in a controlled repository, with versioning and formal approval;
- Allow temporary exceptions that are justified, traceable and have automatic expiry;
- Continuously measure and review the effectiveness of enforcement (blocks, exceptions, bypass).
⚖️ How it must be done
| Component | Technical prescription |
|---|---|
| Policy engine | OPA/Rego, Sentinel (HashiCorp), Conftest, InSpec |
| Model | Declarative, versioned and testable Policy-as-Code |
| Trigger | Mandatory execution on PR/MR, pre-merge and pre-apply |
| Severity | Classification by impact (warn / block), aligned with L1–L3 |
| Feedback | Clear, actionable messages per violated rule |
| Logging | Central record of results per project, commit, author and environment |
| Exceptions | Controlled per rule, with justification, TTL and AppSec/GRC approval |
🗓️ When to apply
| Moment | Expected action |
|---|---|
| Pull Request with IaC | Mandatory execution of policy checks |
| Pre-apply in real environments | Blocking enforcement before any apply |
| Policy update | Review and controlled rollout of the rules |
| Bypass detection | Immediate alert + root cause analysis |
💼 Practical examples
✏️ Example Rego rule (OPA)
deny[msg] {
input.resource_type == "aws_s3_bucket"
not input.tags.Environment
msg := "Missing mandatory 'Environment' tag on S3 bucket"
}
🌍 Integration into the pipeline (GitHub Actions)
- name: Policy enforcement (OPA)
run: conftest test ./iac/envs/prod
Expected result:
- Violation → immediate fail of the job;
- Clear message associated with the rule;
- Evidence persisted for auditing.
📈 Direct benefits
- Reduction of risk from human error or omission;
- Consistent application of organisational policies;
- Objective and reproducible auditing;
- Less dependence on manual review;
- Solid technical foundation for zero trust in IaC.
🔗 Cross-references
| Document | Relation to this file |
|---|---|
addon/02-validacoes-e-checks.md | Technical validations and quality before enforcement |
addon/04-principios-sbd-iac.md | Fail securely, least privilege, controlled visibility |
addon/11-uso-ferramentas-automatizadas-iac.md | Specific rules for automation and external tools |
canon/20-checklist-revisao.md | Binary verification of policy application |