Skip to content

Security Policy as Code

Architectural Context

Detailed reference for Security Policy as Code in the context of Hardened Infrastructure.

Standard Reference

Cloud Infrastructure

Kubernetes

Policy-as-Code

  • Kyverno 🌟 [DE FACTO STANDARD] — A CNCF graduated Kubernetes-native policy engine.

  • Allows policy definition as standard Kubernetes resources (YAML).

  • Eliminates the need for complex DSLs like Rego.
  • Simplifies admission control, generation, mutation, and validation of workloads.
  • kyverno.io: 56 sample policies 🌟 [DOCUMENTATION] [ENTERPRISE-STABLE] — A rich library of ready-to-use Kyverno policy definitions. These templates address common cloud security standards (Pod Security Standards, multi-tenancy constraints, best practices, and resource optimization parameters) for instant cluster hardening.

Cloud Native Security

Policy Enforcement

Open Policy Agent

  • (2021) infracloud.io: Kubernetes Pod Security Policies with Open Policy Agent [EN CONTENT] [ADVANCED LEVEL] [COMMUNITY-TOOL] — Addresses the transition from obsolete Kubernetes Pod Security Policies (PSPs) to Open Policy Agent (OPA) Gatekeeper. Explores how to leverage declarative constraints using the Rego engine to strictly manage admission control actions.

Identity and Access Management

Cloud IAM

Microsoft Entra

  • Configure Microsoft Entra for Increased Security [DOCUMENTATION] [ENTERPRISE-STABLE] — Official documentation outlines hardening parameters for Microsoft Entra ID. Features prescriptive blueprints for setting up conditional access, continuous access evaluation, Multi-Factor Authentication (MFA), and role-based identity management.

Platform Engineering

Site Reliability Engineering

Foundations

Public Cloud Platforms

AWS

EKS Security and Isolation

Policy Management

Security

DevSecOps

SAST

  • GitHub Code Security Risk Assessment: Free Vulnerability Scanning [EN CONTENT] [COMMUNITY-TOOL] — An introduction to GitHub's native, free vulnerability scanning tools designed to locate security regressions, secrets, and supply chain threats directly within the code repository. It highlights automated security alerts and quick enablement configurations.

💡 Explore Related: IaC | Terraform | Ansible