Turn the policy PDF into an enforced rule.

Instead of a wiki page nobody reads, express the policy as version-controlled code, automatically enforced on every single change — exactly like any other test.

Old way

A PDF nobody reads

"S3 buckets must not be publicly readable" — relies on a human remembering to check, manually, every time.

Security as code

An enforced rule

The same rule, written as an automated policy check — enforced on every change, every time, with zero reliance on memory.

policy.rego

package terraform.s3

deny[msg] {
  input.resource_type == "aws_s3_bucket"
  input.values.acl == "public-read"
  msg := sprintf("bucket '%s' must not be public", [input.address])
}

# run it against a Terraform plan, in CI
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json
opa eval --data policy.rego --input tfplan.json "data.terraform.s3.deny"

If a rule isn't automatically enforced on every change, it's a suggestion, not a rule — this same idea returns as admission controllers (Module 3) and IaC scanning (Module 5).