Policy as Code with OPA: Practical Guide

What is policy as code?

Policy as code means defining governance rules in a machine-readable format that can be evaluated automatically against infrastructure changes. Instead of manual security reviews or tribal knowledge about what's allowed, policies are written as code, version-controlled, tested, and enforced at the right point in the CI/CD pipeline. Open Policy Agent (OPA) is the most widely adopted engine for this, using the Rego language to express policies as declarative rules.

Writing your first Rego policy

Start simple. A basic policy might check that all AWS S3 buckets have encryption enabled. In Rego:

• package main
• deny[msg] {
• input.resource_type == "aws_s3_bucket"
• not input.server_side_encryption_configuration
• msg := sprintf("Bucket %v must have encryption enabled", [input.bucket_name])
• }

This policy reads resource data from input, checks whether encryption configuration exists, and produces a denial message if it doesn't. The key insight is that Rego policies operate on structured data: they don't parse YAML or JSON text; they work with already-parsed objects.

Testing policies before deployment

OPA includes `opa test` for unit testing policies. Write test cases that cover both passing and failing scenarios. For example, test that a bucket with encryption passes the policy, while one without encryption fails. Use `opa eval` to manually test policies against sample input data during development. Always version-control your policies alongside your infrastructure code.

Terraform plan ──▶ policy-as-code evaluator                              │              ┌──────┬────────┼────────┐              │ Pass │ Fail   │ Warn   │              └──────┴────────┴────────┘                              │              allow apply     deny/block    log-only

Integrating with Terraform/OpenTofu

The most common integration point is evaluating policies against Terraform plans before apply. Tools like Conftest, Sentinel, or Devopsify's built-in policy engine can read plan output (JSON format) and evaluate Rego policies against it. The workflow: generate plan → convert to JSON → run OPA evaluation → block or warn based on results. This catches violations before they reach production.