Amey-Thakur Policy as code
A policy nobody can check is a suggestion. Encoding rules as automated checks makes compliance the default and makes exceptions visible rather than invisible.
Method
- Encode rules that are objectively checkable. Encryption enabled, tags present, no public buckets. Judgement-based standards belong in review rather than automation.
- Evaluate at the earliest useful point. In the editor, then in the pipeline, then at deployment, because feedback is cheaper the earlier it arrives (see github-actions-workflows).
- Explain the violation and the fix. A policy failure naming the rule and the remedy gets fixed; an opaque denial gets escalated (see error-messages).
- Start in warning mode. Measure how often a rule would fire before enforcing it, since a rule blocking half of all deployments was wrong.
- Provide a documented exception path. Time-limited, owned, and reviewed, because rules without exceptions are bypassed entirely (see agent-compliance-desk).
- Version policies and test them. Policy is code with the same need for review and regression testing.
- Report on drift, not just on blocks. Existing resources violating a new policy need a remediation plan rather than silent tolerance.
Boundaries
Automated policy covers what is machine-checkable, which is a subset of what matters. Over-strict policy pushes work outside the governed path. Policy enforces rules and does not establish whether they are the right rules (see agent-compliance-desk).