Compliance Automation with Policy-as-Code

Compliance automation replaces spreadsheets and annual audits with code that continuously verifies every system meets every requirement, every hour. The shift from periodic manual audits to continuous automated checks isn’t just about efficiency — it’s about catching violations in minutes instead of months.

---

Policy-as-Code Frameworks

Framework	Author	Language	Best For
OPA (Open Policy Agent)	CNCF	Rego	Kubernetes, API authorization, Terraform
Sentinel	HashiCorp	Sentinel	Terraform Enterprise/Cloud policies
AWS Config Rules	AWS	Lambda/Managed	AWS resource compliance
Azure Policy	Microsoft	JSON	Azure resource governance
GCP Organization Policy	Google	YAML/JSON	GCP resource constraints
InSpec	Chef/Progress	Ruby DSL	Server and cloud compliance testing
Checkov	Bridgecrew/Palo Alto	Python/YAML	IaC scanning (Terraform, CloudFormation)
Kyverno	CNCF	YAML	Kubernetes-native policies

---

Compliance Enforcement Points

Code commit:
    → Pre-commit hooks (secret scanning)

Pull request:
    → IaC policy scan (Checkov, tfsec)
    → OPA policy evaluation

Build:
    → Container image scanning
    → SBOM generation

Deploy:
    → Kubernetes admission control (OPA Gatekeeper, Kyverno)
    → Terraform Sentinel policies

Runtime:
    → AWS Config / Azure Policy continuous monitoring
    → Cloud Security Posture Management (CSPM)

Audit:
    → Automated evidence collection
    → InSpec compliance scans

---

OPA (Open Policy Agent) Patterns

Use Case	Integration	What It Controls
Kubernetes admission	Gatekeeper webhook	What pods/services can be created
Terraform validation	Conftest or TFC	What infrastructure changes are allowed
API authorization	Sidecar or library	Who can access what data
CI/CD gates	Pipeline step	Whether a build can proceed

---

Cloud Compliance Monitoring

Framework	AWS Tool	Azure Tool	GCP Tool
CIS Benchmarks	Security Hub	Defender for Cloud	Security Command Center
SOC 2	AWS Artifact + Config	Compliance Manager	Compliance Reports
PCI DSS	Config Rules (PCI pack)	Regulatory Compliance	Assured Workloads
HIPAA	Config Rules (HIPAA pack)	Regulatory Compliance	Assured Workloads
ISO 27001	Config Rules + manual	Compliance Manager	Compliance Reports

---

Automated Evidence Collection

Evidence Type	Automation Tool	Storage
System configuration snapshots	AWS Config, InSpec	S3/blob storage, retained per policy
Access control lists	IAM API exports	Versioned compliance repository
Encryption status	Cloud API queries	Compliance dashboard
Network configurations	VPC/NSG exports	Infrastructure state snapshots
Change management records	Git history, CI logs	Immutable log storage
Vulnerability scan results	Scanner API exports	Compliance repository

---

Continuous Compliance Dashboard

Metric	Green	Yellow	Red
Policy compliance rate	> 98%	90-98%	< 90%
Finding remediation SLA	All within SLA	< 5 overdue	> 5 overdue
Drift from baseline	No drift	Non-critical drift	Critical drift
Evidence freshness	< 24 hours	1-7 days	> 7 days old
Control coverage	100% automated	> 80% automated	< 80% automated

---

Anti-Patterns

Anti-Pattern	Problem	Fix
Compliance as annual event	364 days of non-compliance possible	Continuous automated monitoring
Manual evidence collection	Time-consuming, error-prone, stale	Automated collection with API integrations
Policies in documentation only	No enforcement, no verification	Policy-as-code with automated enforcement
Alert fatigue from too many findings	Team ignores all findings	Prioritize by severity, fix systematically
One framework for everything	Poor fit, gaps in coverage	Layer tools: cloud-native + IaC scanning + runtime monitoring

---

Checklist

• Compliance requirements mapped to specific technical controls
• Policy-as-code framework selected (OPA, Checkov, or cloud-native)
• Enforcement at PR time (IaC scanning) and deploy time (admission control)
• Cloud compliance monitoring enabled (AWS Config, Azure Policy, GCP SCC)
• Automated evidence collection for all major control areas
• Compliance dashboard with real-time status
• Finding tracking with remediation SLAs
• Drift detection scheduled (daily minimum)
• Audit-ready report generation automated
• Quarterly compliance review with stakeholders

---

:::note[Source] This guide is derived from operational intelligence at Garnet Grid Consulting. For compliance automation consulting, visit garnetgrid.com. :::