Policy-as-Code for Infrastructure-as-Code with OPA and OpenTofu
Talkat OpenTofu Day North America 2024 · on Tuesday, 2024-11-12· at 16:40· Salt Palace | Level 2 | 250 D·
summary
Shows concrete wiring of OpenTofu + OPA using Rego to enforce repo and resource rules: use tofu show -json pipe into opa to detect planned deletions, block a flagged GitHub team membership, and reject an attempted change that would destroy two resources; earlier plan shows 14 resources to create. Demonstrates ConfTest for static TF file checks, module-based reuse to enforce policies across repos, and a dynamic deletion policy that queries an inventory API from Rego to allow or deny deletes at runtime.
AI-written summary · about
chapters (7)
- 0:00Introduction to OPA and Rego
- 1:30Understanding Rego
- 4:07Building an automation pipeline
- 9:44Implementing deletion prevention
- 15:38Inventory management and state
- 19:15Dynamic policy evaluation
- 22:42Conclusion and resources
related talks
18mImplementing Unit Tests for Terraform with Open Policy Agent
30mGitops with Policy As Code and OPA
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
40mOPA Introduction & Community Update
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
25mOPA Policy Templating and Testing - Tejas Cherukara, ANZ Bank & Ben Ebsworth, Digio
29mIntroduction to Open Policy Agent
41mTaking Command of Cloud Security with OPA