Policy as Code

Enforce infrastructure policies on Terraform and CDK workflows in CI/CD pipelines.

1|Updated Jan 26, 2026

Search Tags:#compliance #policy #guardrails #opa #conftest #checkov #iaac

Ready to run

npx skills add https://github.com/nicolasmosquerar/AI-skills-for-Iac --skill policy-as-code

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Policy as Code
Source: https://github.com/nicolasmosquerar/AI-skills-for-Iac/tree/main/.agent/skills/policy-as-code
Command: npx skills add https://github.com/nicolasmosquerar/AI-skills-for-Iac --skill policy-as-code

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Policy governance is critical to prevent misconfigurations and compliance gaps by codifying rules into testable code that runs in CI.

Core Features & Use Cases

OPA/Conftest policy authoring and testing for Terraform and CDK
Checkov and SCP-based guardrails for cloud security and compliance
CI integration and policy validation for pipelines

Quick Start

Run policy tests in CI against your Terraform/CDK codebase using Conftest and Checkov.

Frequently Asked Questions about Policy as Code

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce infrastructure policies in CI/CD pipelines?▼

You can enforce infrastructure policies by integrating policy checks directly into your CI/CD pipelines using Conftest and Checkov to validate Terraform and CDK codebases. This prevents misconfigurations before deployment.

What is policy as code for infrastructure?▼

Policy as code codifies compliance rules into testable code that runs in CI, applying security guardrails to infrastructure pipelines. This mechanism prevents misconfigurations and compliance gaps across Terraform and CDK workflows.

Can I use OPA and Conftest to test Terraform configurations?▼

Yes, you can use OPA and Conftest for policy authoring and testing against your Terraform configurations. This allows you to validate infrastructure code against custom compliance rules before deployment.

Does this policy enforcement approach support AWS SCP guardrails?▼

Yes, the policy enforcement approach supports SCP-based guardrails alongside Checkov for cloud security. This ensures infrastructure deployments meet necessary compliance and governance requirements across environments.

What is the best way to prevent cloud infrastructure misconfigurations?▼

The best way to prevent cloud misconfigurations is codifying infrastructure rules into testable code that runs in CI. Applying Conftest and Checkov validations to IaC workflows catches compliance gaps early.

Why do I need policy checks for CDK workflows?▼

You need policy checks for CDK workflows to prevent compliance gaps by codifying rules into testable code that runs in CI. This validation ensures cloud resources meet security standards before provisioning.