Senior LevelCloud Computing (AWS/GCP/Azure)
How does Policy-as-Code (HashiCorp Sentinel / OPA Conftest) enforce security guardrails in IaC pipelines?
❓ Interview Prompt: Explain Policy-as-Code (Sentinel, OPA Conftest), static Terraform plan inspection, pre-apply enforcement, and compliance automation.
Preventing engineers from provisioning insecure cloud resources (e.g. unencrypted S3 buckets, open 0.0.0.0/0 SSH security groups) requires shift-left Policy-as-Code validation in CI/CD pipelines.
How Policy-as-Code Operates:
1
Engineer submits a Pull Request containing Terraform code.
2
CI pipeline runs 'terraform plan -out=tfplan.binary' and converts the execution plan to JSON.
3
Policy-as-Code engines (OPA Conftest or HashiCorp Sentinel) evaluate declarative rules against the plan JSON before 'terraform apply'!
4
Hard Enforcement: If the plan contains non-compliant resources, the pipeline fails automatically and blocks cloud deployment!
Code Implementation Example
ruby
# OPA Rego Policy inspecting Terraform plan JSON for unencrypted S3 buckets
package terraform.security
deny[msg] {
resource := input.resource_changes[_]
resource.type == "aws_s3_bucket"
not resource.change.after.server_side_encryption_configuration
msg := sprintf("Security Violation: S3 Bucket '%v' must have server-side encryption enabled!", [resource.name])
}💡OPA Rego Policy-as-Code rule inspecting Terraform plan for unencrypted S3 buckets.
🎯 Interview Key Takeaway
Policy-as-Code engines inspect Terraform plan JSON in CI/CD pipelines, automatically blocking non-compliant cloud deployments.
#Policy-as-Code#Sentinel#OPA#Terraform#Senior
Back to all Cloud Computing (AWS/GCP/Azure) Questions→