Policy as Code

Policies are expressed as declarative code that specifies the desired state of the system, not the procedural steps to achieve it. This shifts compliance from manual checklists to automated validation.

• Uses languages like Rego (OPA) or Kyverno policies
• Policies define what is allowed, not how to enforce it
• Example: A policy declares that all S3 buckets containing ePHI must have encryption enabled and public access blocked
• Declarative policies are idempotent — reapplying them produces the same result every time

Policy engines integrate directly into the Kubernetes admission control pipeline, intercepting API requests before resources are persisted. This creates a mandatory compliance gate that cannot be bypassed.

• ValidatingWebhookConfiguration calls the policy engine on resource creation or update
• MutatingWebhookConfiguration can automatically inject compliant defaults, such as adding required labels or sidecars
• Requests that violate policy are rejected with a clear violation message
• Example: A deployment requesting a container to run as root is denied before the pod is scheduled

Policies are stored in Git repositories alongside application code, bringing software development best practices to security governance. Every policy change is auditable, reviewable, and reversible.

• Policy changes go through pull request reviews and CI/CD pipelines
• Git history provides a complete audit trail of who changed what policy and when
• Rollback to a previous policy version is instantaneous
• Example: A HIPAA policy update requiring TLS 1.3 minimum is committed, reviewed by the security team, and deployed automatically across all clusters

Policy engines continuously evaluate the actual state of infrastructure against the declared policy, detecting and remediating configuration drift. This closes the gap between point-in-time audits and real-time enforcement.

• OPA Gatekeeper's audit functionality periodically re-evaluates all existing resources
• Violations are surfaced as Kubernetes constraint violations with timestamps
• Integration with monitoring tools like Prometheus exposes compliance metrics
• Example: An operator manually removes encryption from an S3 bucket; the policy engine detects the drift within minutes and triggers an alert

Reusable ConstraintTemplate resources encode HIPAA technical safeguards as parameterized policies. Security teams define the template once, and operations teams instantiate it with environment-specific parameters.

• Templates define the Rego logic for a class of violations
• Constraints bind the template to specific resources using match criteria
• Parameters allow customization: requiredEncryptionAlgorithm: AES-256
• Example: A RequireEncryptionAtRest template is instantiated with a constraint targeting all namespaces labeled data-classification: phi

Policy as Code enables unit testing of compliance rules before they impact production workloads. This prevents misconfigured policies from blocking legitimate clinical operations.

• OPA's opa test command runs assertions against Rego policies
• Test fixtures simulate both compliant and non-compliant resource manifests
• Conftest integrates policy testing into existing test suites
• Example: A test verifies that a policy correctly allows a FHIR API pod with mTLS enabled while denying one without it