// writing

Policy as Code with OPA and Terraform

5 articles

Policy as code puts a check between terraform plan and apply, so a dangerous change fails the pipeline instead of reaching your AWS accounts. Read the series in this order:

  1. The incident: a deleted state bucket and the guardrail that came out of it.
  2. The first policy: a Rego rule for force_destroy, tested with Conftest and run in CI.
  3. Required AWS tags: tag keys and allowed values, per environment.
  4. Approved AMIs: only images from an approved list.

Shift-left cost checks applies the same idea to cloud cost.

5

4 min read

Allow Only Approved AMIs in Terraform with OPA

An OPA policy that fails the Terraform plan when an EC2 instance uses an AMI that isn't on an approved list, with the list kept in an external JSON data file.

OPATerraformPolicyAsCode

8 min read

Enforcing AWS Resource Tags with OPA

Check a Terraform plan for required AWS tags and allowed values with OPA: common and per-environment rules, plus a whitelist of exempt resources.

OPATerraformPolicyAsCode

6 min read

Testing Terraform Plans with OPA and Conftest (and Atlantis)

A Rego policy that blocks S3 buckets with force_destroy in the Terraform plan, tested with the OPA CLI and Conftest and run in Atlantis or any CI pipeline.

CloudDevOpsOPA

5 min read

How I Learned the Hard Way That Terraform Needs Policy as Code

Case study: a deleted Terraform state bucket forced a rebuild of 15 AWS accounts. How that incident became a policy-as-code guardrail that stops dangerous changes at plan time.

OPATerraformIaC

7 min read

Shift-Left Cost Checks for Terraform with OPA and Terracost

Catch cloud cost problems before apply: OPA policies that block expensive resources in the Terraform plan, Infracost estimates and self-hosted Terracost on MySQL.

OPATerracostIaC