Policy-as-Code Framework

A Policy-as-Code (PaC) framework for enforcing security, compliance (BSI C5, GDPR), and operational policies across cloud infrastructure.

Built with Open Policy Agent (OPA) for policy authoring, Terraform for infrastructure-as-code, and GitHub Actions for CI/CD enforcement.

Part of a PhD research project at the University of Plymouth investigating human-centric Policy-as-Code and cloud misconfiguration governance.

GitHub Pages Status

Item Status
GitHub Pages ✅ Deployed (this site)
CI Pipeline ✅ Active (policy-ci.yml, pac-aws-ci.yml)
OPA Policies ✅ IaaS · PaaS · Spring
Compliance ✅ BSI C5 · GDPR

Architecture 

1
2
3
4
5
6
7
8
9
10
11
12
13

┌──────────────┐
│   Authoring  │  Rego policies with compliance metadata
└──────┬───────┘
       │
       ▼
┌──────────────┐
│  Evaluation  │  OPA evaluates Terraform plans
└──────┬───────┘
       │
       ▼
┌──────────────┐
│ Enforcement  │  CI/CD gates + pre-commit hooks
└──────────────┘

Policy Layers

Layer Scope Policy File
IaaS Networking, compute, security groups policies/iaas/network_security.rego
PaaS Databases, storage, backups policies/paas/database_security.rego
Spring JDK versions, images, logging, TLS policies/spring/runtime_security.rego

Supported Providers

Provider Path Description
STACKIT (primary) terraform/environments/ German public-sector cloud — dev, staging, prod
AWS (demo) terraform/demo-aws/ Compliant vs non-compliant examples

Quick Start 

1
2
3
4
5
6
7
8
9

# Run all policy tests
opa test ./policies ./tests -v

# Check formatting
opa fmt --check --fail policies/ tests/

# Evaluate a resource against policies
echo '{"resource_type":"stackit_compute_instance","environment":"production","values":{"name":"srv-01","public_ip":"1.2.3.4","region":"us-east-1"}}' \
  | opa eval -d policies/ -I 'data.policies.iaas.network_security.deny'

Compliance Mapping

Policies are annotated with:

  • BSI C5: OPS-05, OPS-08, OPS-13, OPS-20, CRY-01, CRY-02, IDM-01
  • GDPR: Art. 5, 25, 32, 44–49

Documentation

University of Plymouth · Cybersecurity PhD · Elias Lenz

University of Plymouth · Cybersecurity PhD · Elias Lenz