Policy as Code and Compliance Checks
Add a guardrail layer to your testing strategy by scanning Terraform plans for security and compliance violations before they reach production.
Policy as Code and Compliance Checks is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Testing Is Not Just Functional
Unit and integration tests prove your infrastructure works. Policy as code proves it is allowed: no public S3 buckets, only approved instance types, required tags present. These checks run automatically against every change.
Where Policy Checks Fit
Policy checks slot between plan and apply. The plan output is analyzed, and a violation blocks the apply, just like a failing test blocks a merge.
Static Scanning with tfsec
tfsec scans your HCL for known misconfigurations without needing cloud credentials. It is fast enough to run on every commit.
tfsec .Reading Scanner Output
Scanners report a rule ID, severity, and the offending resource. Use the ID to look up remediation guidance or to suppress an accepted risk.
Result: aws-s3-enable-bucket-encryption
Severity: HIGH
Resource: aws_s3_bucket.dataCheckov for Multi-Framework Scans
Checkov covers Terraform plus other IaC formats and maps findings to compliance frameworks like CIS and SOC2.
checkov -d . --framework terraformScanning the Plan, Not Just Code
To catch issues that only appear after variable resolution, export the plan to JSON and scan that artifact.
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > plan.json
checkov -f plan.jsonOpen Policy Agent and Conftest
For custom organizational rules, OPA with conftest lets you write policies in the Rego language and test them against the plan JSON.
conftest test plan.json --policy policy/A Simple Rego Policy
This Rego rule denies any S3 bucket whose ACL is set to public-read. Conftest fails the run if the rule matches.
package main
deny[msg] {
r := input.resource_changes[_]
r.type == "aws_s3_bucket"
r.change.after.acl == "public-read"
msg := "S3 buckets must not be public-read"
}Suppressing Accepted Risks
Sometimes a finding is a known exception. Inline comments let you skip a specific rule with an audit trail, instead of disabling the whole scan.
resource "aws_s3_bucket" "logs" {
# tfsec:ignore:aws-s3-enable-bucket-encryption
bucket = "public-logs"
}Failing the Build
In CI, these tools return a non-zero exit code on violations, which fails the pipeline and prevents a non-compliant apply from proceeding.
tfsec . --soft-fail=falseLayering the Checks
A mature pipeline runs fmt and validate first, then static policy scans (tfsec/checkov), then custom OPA rules, and only then the functional Terratest suite. Each layer catches a different class of problem.
Quick Check
Test your policy-as-code knowledge.
Recap: Guardrails for Infrastructure
You added a compliance layer to testing:
- tfsec and Checkov for known-misconfiguration scans.
- OPA/conftest with Rego for custom org rules.
- Scan the plan JSON to catch resolved-value issues.
- Non-zero exit codes block non-compliant applies in CI.
Frequently asked questions
Is the “Policy as Code and Compliance Checks” lesson free?
Yes — the full text of “Policy as Code and Compliance Checks” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.
What will I learn in “Policy as Code and Compliance Checks”?
Add a guardrail layer to your testing strategy by scanning Terraform plans for security and compliance violations before they reach production. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Policy as Code and Compliance Checks” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Terraform `validate` and `fmt`
- Unit Testing with Terratest
- Integration Testing Cloud Resources
- Policy as Code and Compliance Checks