# Policy As Code

> Implement policy as code with OPA, Sentinel, and Kyverno. Automate policy enforcement in CI/CD and infrastructure. Use when enforcing compliance through automation.

- Skill: `majiayu000/policy-as-code-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/policy-as-code-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/policy-as-code-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/policy-as-code-2

---


# Policy as Code

Automate policy enforcement through code.

## Open Policy Agent (OPA)

```rego
# deny_public_buckets.rego
package terraform.s3

deny[msg] {
    resource := input.resource.aws_s3_bucket[name]
    resource.acl == "public-read"
    msg := sprintf("S3 bucket '%s' has public ACL", [name])
}
```

## Kyverno (Kubernetes)

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: enforce
  rules:
  - name: check-labels
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Label 'app' is required"
      pattern:
        metadata:
          labels:
            app: "?*"
```

## Checkov

```bash
# Scan Terraform
checkov -d . --framework terraform

# Custom check
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

class S3Encryption(BaseResourceCheck):
    def scan_resource_conf(self, conf):
        return CheckResult.PASSED if 'encryption' in conf else CheckResult.FAILED
```

## Best Practices

- Version control policies
- Test policies in CI
- Gradual rollout (warn → enforce)
- Exception management