Cloud & Infrastructure Practical By Samson Tanimawo, PhD Published Mar 8, 2026 4 min read

IaC Policy as Code (OPA, Sentinel)

Policy as code enforces guardrails on IaC. The patterns that work and the tools available.

Common rules

All EC2 must have specific tags.

S3 buckets must have encryption.

Public-facing resources require security review.

OPA / Conftest: vendor-neutral.

Terraform Sentinel: integrated with Terraform Cloud.

AWS Config: post-deploy detection.

Policy checks in PR CI. Failed policies block merge.

Override possible for emergencies; logged.