Use this skill to define, enforce, and audit governance policies across cloud infrastructure and Kubernetes using Open Policy Agent (OPA), Azure Policy, AWS Service Control Policies, and Kubernetes Gatekeeper. Triggers: any request to create or update a governance policy, enforce tagging standards, restrict resource types or regions, audit policy compliance, generate a policy violation report, set up guardrails for developer self-service, or implement a platform governance framework.
Codify, deploy, and audit governance policies across the cloud stack. Shift governance left — enforce standards at PR time, admission time, and continuously in production — using OPA/Gatekeeper, Azure Policy, and SCPs.
Enforce governance policies across infrastructure environments with automated remediation.
Policies Enforced:
Workflow:
Output: Governance compliance report with violation details, remediation actions taken, and compliance score.
| Layer | Tool | Enforcement point |
|---|---|---|
| IaC (pre-plan) | conftest + OPA Rego | CI/CD pipeline gate |
| K8s admission | Gatekeeper (OPA) | kubectl apply |
| Azure platform | Azure Policy + Initiatives | ARM deployment |
| AWS platform | Service Control Policies | IAM evaluation |
| Runtime | Falco | Continuous |
| Git (pre-commit) | Custom OPA + conftest | Developer workstation |
Required tags: tenant, env, owner, cost_center, managed_by
# conftest/terraform/tagging.rego
package terraform.tagging
required_tags := {"tenant", "env", "owner", "cost_center", "managed_by"}
deny[msg] {
resource := input.resource_changes[_]
resource.change.actions[_] == "create"
missing := required_tags - {tag | resource.change.after.tags[tag]}
count(missing) > 0
msg := sprintf(
"Resource %v is missing required tags: %v",
[resource.address, missing]
)
}
# Run at PR time
conftest test terraform/plan.json -p conftest/terraform/
{
"if": {
"not": {
"field": "location",
"in": ["eastus", "westeurope", "southeastasia", "global"]
}
},
"then": { "effect": "Deny" }
}
{
"if": {
"allOf": [
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
{ "field": "Microsoft.Compute/virtualMachines/sku.name",
"notIn": ["Standard_D2s_v3","Standard_D4s_v3","Standard_D8s_v3",
"Standard_E2s_v3","Standard_E4s_v3"] }
]
},
"then": { "effect": "Deny" }
}
# conftest/terraform/network.rego
package terraform.network
deny[msg] {
resource := input.resource_changes[_]
resource.type == "azurerm_network_interface"
resource.change.after.ip_configuration[_].public_ip_address_id != null
contains(resource.change.after.tags.env, "prod")
msg := sprintf(
"Production NIC %v must not have a public IP",
[resource.address]
)
}
helm upgrade --install gatekeeper gatekeeper/gatekeeper \
--namespace gatekeeper-system --create-namespace \
--set replicas=3
apiVersion: templates.gatekeeper.sh/v1