In the modern world especially in this cloud native era, security is a mandatory and paramount task in any enterprise. Modern stacks such as Infrastructure-as-Code (IaC) bring us enormous benefits but at the same time it also introduces complexity and challenges to the operation team.

There are many questions and concerns required attention from the operation team, and these questions and concerns are policies (bunch of conditions, rules and criteria). For example:

• Who can access production database?

• Which ingress and egress traffic are allowed to access my resources?

• How could I detect malicious codes before production deployment?

• Which docker binary can be downloaded from?

All organisations have their own policies to compliance with legal requirements in respective industry, hence let's deep dive on how to enforce and handle these policies in a more efficient and effective manner.

Why Policy-as-Code (PaC)?

To enforce policy in organisation level, it is actually a very challenging task since this involve different departments and each of them have unique set of policies. For instance, finance team might not have the same policies as the engineering team.

There are few significant drawbacks of traditional policy enforcement process:

1. Version control of a policy. One can never guarantee that a policy will never be broken and updated. People in the organisation might using different version of policy and it is not practical to propagate the policy changes to the whole organisation all the time.

2. Modern organisations are using agile framework to run their business nowadays, which means many employees, teams, external parties continue to grow in/out the organisation. There is literally impossible for the security team to protect company assets using traditional processes.

3. Human error is usually the main cause where a policy is compromised.

This is where Policy-as-Code come to play. PaC has benefits as below:

Policy as Code (PaC) refers to the practice of writing code to manage and enforce policies in an automated and scalable manner. There are several benefits associated with using Policy as Code:

1. Automation:

   • PaC allows policies to be automated and embedded directly into the deployment pipeline. This automation ensures that policies are consistently applied throughout the development lifecycle.

2. Consistency:

   • By codifying policies, you can ensure consistent application and enforcement across different environments. This consistency helps in preventing configuration drift and ensures that policies are uniformly applied.

3. Scalability:

   • As your infrastructure scales, manually enforcing policies becomes impractical. PaC allows policies to scale alongside your infrastructure, making it easier to manage policies across a large and dynamic environment.

4. Version Control:

   • Code written for policy enforcement can be version-controlled using tools like Git. This provides a history of changes, facilitates collaboration, and allows for the rollback to previous versions if needed.

5. Collaboration:

   • PaC enables collaboration among teams working on infrastructure and policies. Developers, operations, and security teams can work together to define and modify policies, leading to better alignment across different functions.

6. Auditability:

   • Since policies are expressed as code, it becomes easier to audit and track changes. You can see who made changes, what changes were made, and when they were made. This is crucial for compliance and governance.

7. Agility:

   • With PaC, policies can be updated and deployed quickly. This agility is important in dynamic environments where requirements may change rapidly. Code-based policies are amenable to continuous integration and continuous deployment (CI/CD) practices.

8. Prevention of Misconfigurations:

   • PaC helps in preventing misconfigurations by codifying best practices and policies directly into the deployment process. This reduces the likelihood of human errors leading to security vulnerabilities or operational issues.

9. Self-Service:

   • Teams can define and manage their policies through code, promoting a self-service model. This reduces dependencies on central teams and accelerates the development and deployment process.

Introduction to Open Policy Agent (OPA)

OPA is a general purpose policy engine that unifies policy enforcement across different stacks such as Kubernetes, Envoy and even your application. OPA provides high level declarative language Rego that lets you specify policy as code and offload decision making from your application/software.

package com.opa.example

# Define the roles that have access to the API endpoint
allowed_roles = {
    "admin",
    "developer"
}

# Default rule to deny access
default allow_access = false

# Rule to allow access if the user has the required role
allow_access {
    input.method == "GET"   # Allow only GET requests
    input.path == ["api", "endpoint"]
    input.user_roles[_] == allowed_roles[_]
}

# Rule to allow admin POST
allow_access {
    input.method == "POST"   # Allow POST requests
    input.path == ["api", "endpoint"]
    input.user_roles[_] == "admin"
}

Policy as Code (PaC) ensures consistency and security by codifying rules governing infrastructure and application behavior. This approach allows automated enforcement, version control, and collaboration, fostering agile development and reducing manual errors. PaC enhances governance, accelerates compliance, and aligns policies with the dynamic nature of modern cloud and software environments.