Policy as Code: Gate Plans, Not Just Code

1. 1

   Look at a plan as JSON

   Everything a policy needs is in resource_changes. Here's the summary for a plan that replaces the task definition, the everyday deploy.

   terminalcopy cmd

   $ cd infra && ./tf dev plan -out=tfplan >/dev/null

   terraform show -json tfplan | jq -c '.resource_changes[] | select(.change.actions != ["no-op"]) | {address, type, actions: .change.actions}'

   ── expected output ──

   {"address":"module.service[\"api\"].aws_ecs_service.this","type":"aws_ecs_service","actions":["update"]}

   {"address":"module.service[\"api\"].aws_ecs_task_definition.this","type":"aws_ecs_task_definition","actions":["delete","create"]}

2. 2

   Write the policies

   Two rules. First: deleting or replacing a resource of a protected type is denied. prevent_destroy covers some resources in code; this covers every resource of those types, including ones inside modules and ones someone forgot to protect. Second: no ingress rule may expose port 22 to 0.0.0.0/0, checked against the AFTER values, so it catches variables and module inputs too. Rego v1 syntax (import rego.v1).

   package terraform.plan
   
   import rego.v1
   
   protected_types := {
     "aws_db_instance",
     "aws_s3_bucket",
     "aws_vpc",
     "aws_ecr_repository",
   }
   
   deny contains msg if {
     some rc in input.resource_changes
     rc.type in protected_types
     "delete" in rc.change.actions
     msg := sprintf("%s (%s) would be deleted or replaced — needs an explicit, reviewed exception", [rc.address, rc.type])
   }
   
   deny contains msg if {
     some rc in input.resource_changes
     rc.type == "aws_vpc_security_group_ingress_rule"
     after := rc.change.after
     after.cidr_ipv4 == "0.0.0.0/0"
     after.from_port <= 22
     after.to_port >= 22
     msg := sprintf("%s opens SSH (22) to the internet", [rc.address])
   }

3. 3

   Run conftest locally

   The everyday deploy plan passes: an ECS task definition isn't a protected type.

   terminalcopy cmd

   $ terraform show -json tfplan > tfplan.json

   conftest test tfplan.json --policy ../policy --namespace terraform.plan

   ── expected output ──

   2 tests, 2 passed, 0 warnings, 0 failures, 0 exceptions

4. 4

   Wire it into the PR job and add CODEOWNERS

   After plan, convert to JSON and run conftest. A failure blocks the merge (make the check required in branch protection). CODEOWNERS requires the platform team's review on anything prod-related or shared.

         # in the plan job, after "plan":
         - uses: instrumenta/conftest-action@master
           with:
             files: infra/tfplan.json
             policy: policy
             namespace: terraform.plan
         # (plan step also runs: terraform show -json tfplan > tfplan.json)
   
   # .github/CODEOWNERS
   /infra/envs/prod.*     @you/platform-team
   /modules/              @you/platform-team
   /policy/               @you/platform-team @you/security

5. 5

   Take prod applies off laptops

   Update the prod shoplite-deployer role's trust policy so it trusts ONLY repo:you/shoplite:environment:prod, removing your SSO identity. Humans keep a read-only role for investigating, plus a break-glass role for emergencies that alerts when used. Dev can keep trusting humans for experimentation.

   terminalcopy cmd

   $ ./tf prod plan

   ── expected output ──

   ╷

   │ Error: Cannot assume IAM Role

   │

   │ with provider["registry.terraform.io/hashicorp/aws"],

   │ on providers.tf line 10, in provider "aws":

   │ 10: provider "aws" {

   │

   │ IAM Role (arn:aws:iam::444455556666:role/shoplite-deployer) cannot be

   │ assumed. ... api error AccessDenied: User: arn:aws:sts::111122223333:

   │ assumed-role/AWSReservedSSO_Developer/priya is not authorized to perform:

   │ sts:AssumeRole on resource: arn:aws:iam::444455556666:role/shoplite-deployer

   ╵

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.