PricingLoginStart free
DevOps Bootcamp · Lesson

Policy as Code and Compliance Checks

Add a guardrail layer to your testing strategy by scanning Terraform plans for security and compliance violations before they reach production.

Lesson 4 of 413 steps

Policy as Code and Compliance Checks is a free DevOps Bootcamp lesson on CoddyKit. This is lesson 4 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, and your progress syncs across the web and the CoddyKit app. The DevOps Bootcamp course includes 4 lessons in total.

Testing Is Not Just Functional

Unit and integration tests prove your infrastructure works. Policy as code proves it is allowed: no public S3 buckets, only approved instance types, required tags present. These checks run automatically against every change.

Where Policy Checks Fit

Policy checks slot between plan and apply. The plan output is analyzed, and a violation blocks the apply, just like a failing test blocks a merge.

Static Scanning with tfsec

tfsec scans your HCL for known misconfigurations without needing cloud credentials. It is fast enough to run on every commit.

tfsec .

Reading Scanner Output

Scanners report a rule ID, severity, and the offending resource. Use the ID to look up remediation guidance or to suppress an accepted risk.

Result: aws-s3-enable-bucket-encryption
Severity: HIGH
Resource: aws_s3_bucket.data

Checkov for Multi-Framework Scans

Checkov covers Terraform plus other IaC formats and maps findings to compliance frameworks like CIS and SOC2.

checkov -d . --framework terraform

Scanning the Plan, Not Just Code

To catch issues that only appear after variable resolution, export the plan to JSON and scan that artifact.

terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > plan.json
checkov -f plan.json

Open Policy Agent and Conftest

For custom organizational rules, OPA with conftest lets you write policies in the Rego language and test them against the plan JSON.

conftest test plan.json --policy policy/

A Simple Rego Policy

This Rego rule denies any S3 bucket whose ACL is set to public-read. Conftest fails the run if the rule matches.

package main

deny[msg] {
  r := input.resource_changes[_]
  r.type == "aws_s3_bucket"
  r.change.after.acl == "public-read"
  msg := "S3 buckets must not be public-read"
}

Suppressing Accepted Risks

Sometimes a finding is a known exception. Inline comments let you skip a specific rule with an audit trail, instead of disabling the whole scan.

resource "aws_s3_bucket" "logs" {
  # tfsec:ignore:aws-s3-enable-bucket-encryption
  bucket = "public-logs"
}

Failing the Build

In CI, these tools return a non-zero exit code on violations, which fails the pipeline and prevents a non-compliant apply from proceeding.

tfsec . --soft-fail=false

Layering the Checks

A mature pipeline runs fmt and validate first, then static policy scans (tfsec/checkov), then custom OPA rules, and only then the functional Terratest suite. Each layer catches a different class of problem.

Quick Check

Test your policy-as-code knowledge.

Answer it in the interactive lesson

Recap: Guardrails for Infrastructure

You added a compliance layer to testing:

  • tfsec and Checkov for known-misconfiguration scans.
  • OPA/conftest with Rego for custom org rules.
  • Scan the plan JSON to catch resolved-value issues.
  • Non-zero exit codes block non-compliant applies in CI.
Free to start

Learn DevOps Bootcamp with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses
142
Lessons
568
Start learning freeView the full course

Frequently Asked Questions

Is the “Policy as Code and Compliance Checks” lesson free?

Yes — any 3 lessons of the DevOps Bootcamp learning path, including “Policy as Code and Compliance Checks”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The DevOps Bootcamp course includes 4 lessons in total.

What will I learn in “Policy as Code and Compliance Checks”?

Add a guardrail layer to your testing strategy by scanning Terraform plans for security and compliance violations before they reach production. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “Policy as Code and Compliance Checks” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Terraform `validate` and `fmt`
  2. Unit Testing with Terratest
  3. Integration Testing Cloud Resources
  4. Policy as Code and Compliance Checks
← Back to DevOps Bootcamp