🏛️ Compliance as Code in DevOps
Compliance as Code (CaC) is the practice of codifying regulatory, security, and organizational compliance requirements so they can be automatically tested, enforced, and audited within DevOps pipelines.
It brings the same principles of IaC (Infrastructure as Code) to governance, rules, and policies—making compliance continuous, automated, and scalable.
🎯 Why Compliance as Code Matters
Traditional compliance is:
Manual
Document-heavy
Slow
Error-prone
Done late in the release cycle
CaC turns compliance into automated checks that run throughout the pipeline.
Benefits:
✔ Continuous compliance
✔ Consistent standards across teams
✔ Faster audits
✔ Reduced manual overhead
✔ Automated drift detection
✔ Fail fast when configurations violate policy
✔ Enforces security + regulatory requirements (PCI, HIPAA, ISO27001, SOC2)
🧩 What Exactly Is “Compliance as Code”?
CaC means representing compliance requirements using machine-readable policies, such as:
Resource must be encrypted
S3 bucket must not be public
Kubernetes pods must not run as root
Password complexity rules must be enforced
Logs must be retained for 1 year
Policies are defined in:
Rego (OPA)
Sentinel (HashiCorp)
YAML/JSON rules (Checkov, Terrascan, Kics)
Cloud policy engines (Azure Policy, AWS Config, GCP Org Policy)
These policies are then automatically evaluated in CI/CD and in production.
🧰 Tools for Compliance as Code
1️⃣ OPA (Open Policy Agent) — The most widely-used CaC engine
Uses Rego policy language
Works with Kubernetes, Terraform, microservices, APIs
Embeddable in CI/CD, admission controllers, and services
2️⃣ Conftest
Uses OPA Rego to test configuration files (K8s YAML, Terraform, Helm, Dockerfiles)
3️⃣ Checkov
IaC compliance for Terraform, Bicep, CloudFormation, K8s, Docker
Comes with built-in policies mapped to CIS, NIST, PCI, etc.
4️⃣ HashiCorp Sentinel
Policy-as-code engine for Terraform Enterprise, Consul, Vault
5️⃣ Cloud-native compliance tools
Azure Policy
AWS Config + Security Hub
GCP Organization Policy
Kubernetes Pod Security Standards (PSS)
OPA Gatekeeper (K8s admission controller)
6️⃣ CIS Benchmark tools
Chef InSpec
Lynis
OpenSCAP
🏗️ Where Compliance as Code Fits in the DevOps Pipeline
Compliance checks can run at multiple stages:
🔵 1. Developer / Pre-Commit Stage
Run static checks before code is committed.
Tools:
Conftest
Checkov
TFLint
Secrets scanners
Example:
Block a commit if a Terraform file opens port 22 to the world.
🟡 2. CI Pipeline
Validate IaC, Docker, Kubernetes, and configuration files.
Enforce encryption at rest
Prevent privileged containers
Ensure tags/labels are present
Validate cloud resources meet audit rules
Example GitHub Action:
- name: Run Checkov
uses: bridgecrewio/checkov-action@master
🟠 3. CD Pipeline (before deployment)
Gate deployments with policies.
OPA Gatekeeper or Kyverno for Kubernetes
Terraform Sentinel policies
Azure Policy for ARM/Bicep deployment validation
Example:
❌ Block deployment if:
S3 bucket is public
Password policy is weak
TLS is not enforced
🔴 4. Runtime / Monitoring
Detect and fix configuration drift.
Tools:
Azure Policy remediation
AWS Config auto-remediation
Falco for K8s runtime rules
OPA agents continuously enforcing policies
📘 Example: OPA Rego Policy (Simple Compliance Rule)
Deny Terraform resources without encryption:
package terraform
deny[msg] {
resource := input.resource.aws_s3_bucket
not resource.server_side_encryption_configuration
msg := sprintf("S3 bucket %s must have encryption enabled", [resource.bucket])
}
Run via Conftest in CI.
📦 Example: Compliance as Code in a DevOps Pipeline (Simple)
GitHub Actions Pipeline Example
name: DevSecOps
on: [push]
jobs:
compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Check IaC Compliance (Terraform)
uses: bridgecrewio/checkov-action@master
- name: OPA Policy Check
uses: open-policy-agent/conftest-action@v1
with:
path: ./manifests
- name: SBOM + Dependency Scan
uses: anchore/scan-action@v3
🛡️ Common Compliance Controls Automated via CaC
Cloud Compliance
No open security groups
Mandatory encryption
Enforce tagging for auditing
No public cloud storage buckets
Kubernetes Compliance
No privileged containers
Mandatory resource limits
Disallow host networking
Enforce namespace-level boundaries
Application Compliance
Secure headers
Mandatory authentication
No hardcoded credentials
Policies for Regulatory Requirements
PCI DSS
HIPAA
FedRAMP
CIS Benchmarks
SOC2 Logging/Monitoring Controls
CaC automates checking these controls continuously.
🧱 Best Practices for Compliance as Code
✔ Shift compliance left
Run policy checks as early as possible.
✔ Use version-controlled policy libraries
Policies are code → treat them like code.
✔ Apply policy gates in CI/CD
Fail pipelines on critical violations.
✔ Automate drift detection
Continuously watch for changes in cloud infrastructure.
✔ Provide developers self-service compliance
Fast feedback → fewer violations.
✔ Track compliance dashboards
Using tools like:
Prisma Cloud
Azure Security Center
AWS Security Hub
✔ Map policies to frameworks
Maintain a “Policy → Regulation” mapping.
Example: CIS 3.1.1 → S3 encryption policy.
🎯 Final Summary
Compliance as Code = using code and automation to enforce compliance policies in DevOps pipelines.
A mature CaC program includes:
Policy definitions (Rego/Sentinel/YAML)
Automated CI checks
Deployment gates
Runtime enforcement
Drift detection
Cloud, IaC, K8s, and application-level controls
This reduces risk, speeds up auditors, and ensures continuous compliance across environments.
Learn DevOps Training in Hyderabad
Read More
Automated Security Testing in DevOps
Shift Left Security: What It Means
Integrating Security into DevOps Pipelines
Visit Our Quality Thought Institute in Hyderabad
Subscribe by Email
Follow Updates Articles from This Blog via Email
No Comments