Policy as code is the practice of writing organizational rules, such as security, compliance and operational standards, as machine-readable code. The policies are versioned in Git, reviewed like any other change, and enforced automatically by tools, so every piece of code is checked against the same rules.
Without policy as code, rules live in wiki pages and reviewers’ heads. They’re enforced inconsistently and are hard to audit. With it, a rule like “every S3 bucket must be encrypted” becomes a check that runs on every pull request.
Policy as code examples
- Terraform: block any
aws_s3_bucketwithout server-side encryption. - Terraform: allow only approved providers and pinned provider versions.
- Ansible: forbid
ansible.builtin.shellwhere a dedicated module exists. - Ansible: require fully qualified collection names (FQCNs) for every module.
Policy as code tools: Open Policy Agent (OPA) with Rego, Conftest, HashiCorp Sentinel and Kyverno are common general-purpose engines. Steampunk Spotter provides custom policies for Ansible and Terraform code, and those policies can also be given to AI coding assistants as context so generated code conforms from the start.
In Steampunk Spotter, rules like these run as custom policies on Ansible and Terraform code at commit and in CI/CD. A violation fails the build before the code reaches an execution platform such as Red Hat AAP or Spacelift, and every result is recorded for audits.
