Exceptions in IaC
The base process, approval authorities, mandatory fields, chain of authority and lifecycle are defined in Ch. 14 -
addon/12-processo-excecoes.md. This file defines only the specifics of this domain.
Scope
Exceptions to security policies and controls applied by policy engines (OPA, Sentinel, Rego) to IaC modules, resources and pipelines - requirements IAC-001 to IAC-013.
Triggers specific to this domain
- an IaC validation tool unavailable with a need for a deploy documented as urgent;
- a requirement technically impossible to apply to the module or resource concerned, with an architectural justification;
- an intentional deviation in a staging environment with an active compensating control;
- a legacy module integrated without support for the current policies, with a migration plan.
Additional mandatory fields (IaC)
| Field | Mandatory | Notes |
|---|---|---|
| Affected environment | Yes | staging / production / shared |
| Affected IaC artefact | Yes | Name of the module, resource or pipeline |
| Violated rule / policy | Yes | OPA / Sentinel / Rego rule ID |
Record in the repository
File: exceptions/ directory in the IaC repository, or a dedicated central repository with traceable equivalence.
Format: versioned YAML or JSON. .md format only for documentary exceptions without policy engine integration.
id: IAC-EXC-003-2025-07-10
requisito: IAC-003
ambiente: staging
artefacto_afetado: pipeline-iac-staging
justificacao: "Deploy urgente para restauro de capacidade após incidente P1"
impacto: "Possível omissão temporária de detecção de má configuração"
mitigacao: "Execução manual de tfsec pós-deploy + revisão AppSec"
aprovado_por: "appsec@org"
validade: "2025-07-20"
Link to the code: a structured comment on the affected resource:
# iac-exception: IAC-EXC-003-2025-07-10
Integration with policy engines
- Exceptions are assessed per rule and per context - they do not disable rules globally;
- Policy engines (OPA/Sentinel/Rego) must be configured to interpret active exceptions as assessment context;
- Expired exceptions result in automatic blocking of the pipeline - expiry is neither silent nor falls back to a permissive state by default.
Cross-references
| Document | Relation |
|---|---|
addon/06-controle-enforcement.md | Technical handling of exceptions in policy-as-code |
addon/08-matriz-requisitos-iac.md | Requirements IAC-001..013 that may have exceptions |
Ch. 14 - addon/12-processo-excecoes.md | Canonical exception management process |