Automated Infrastructure Compliance Auditing with OPA and Rego Rules in CI CD Pipelines

The Challenge of Compliance in Modern Infrastructure

In modern software engineering, infrastructure is treated as code, meaning servers, networks, and databases are defined by structured text files. However, allowing teams to freely push changes to production often opens the door to misconfigurations, open ports, and the exposure of sensitive data. In practice, this means a single mistaken line in a configuration file can compromise an entire company's security.

Manual peer reviews are slow, prone to human error, and unable to keep up with the fast pace of deliveries. As infrastructure scales, no human being can mentally verify hundreds of corporate and regulatory compliance rules on every single change. This is precisely where the need to automate compliance auditing comes in, turning security policies into a programmatic, impersonal process integrated directly into the software development workflow.

The Role of Open Policy Agent in System Architecture

The Open Policy Agent, widely known as OPA, acts as a unified and independent decision-making engine for the entire technology stack. In practice, think of it as an impartial judge that receives a query about a system's state and responds with a simple verdict: allowed or denied. It separates business policy logic from application code, allowing security rules to be updated without needing to recompile or modify existing software.

When integrated into CI/CD pipelines—the automated workflows where code undergoes tests and validations before going live—OPA evaluates execution plans from tools like Terraform. It analyzes the structure of configuration files before any actual cloud resource is created. If there is any deviation from company guidelines, the pipeline stops immediately, preventing the error from coming to life in sensitive environments.

Writing Business Rules with the Rego Language

The Rego language was created specifically to express policies declaratively, meaning you tell the program what the desired outcome should be rather than dictating every computational step to get there. In practice, Rego operates over structured data in JSON format, navigating property trees to verify if specific conditions are met. The syntax might look exotic at first to those used to traditional languages, but it shines in its ability to express complex security rules in just a few lines.

Below is a practical example of a rule written in Rego that prohibits the creation of cloud storage buckets configured with public access:

package terraform.validation

default allow = false

# Prohibit public access on cloud storage buckets
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    resource.change.after.acl == "public-read"
    msg := sprintf("Resource %v has improper public access", [resource.address])
}

In this code snippet, OPA inspects the input object generated by the infrastructure planner, searches for AWS S3 resources, and checks if the access level is set to public. If found, it generates a detailed error message explaining precisely which resource violated corporate policy.

Integrating Automated Auditing into the CI CD Pipeline

Running rules on a developer's local computer is useful, but true security value is unlocked when the process is automated on the continuous integration server. To implement this workflow in practice, the pipeline must execute well-defined stages that collect infrastructure plans, trigger the policy engine, and interpret the judgment outcome.

Below is a configuration example in a pipeline file that automates this check using the OPA command-line tool:

name: Validate Infrastructure

on: [pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@v3

      - name: Install OPA
        run: |
          curl -L -o opa https://openpolicyagent.org/downloads/v0.60.0/opa_linux_amd64_bsd
          chmod +x opa

      - name: Run policy validation
        run: |
          ./opa eval --data policy.rego --input plan.json "data.terraform.validation.deny"

This workflow ensures that no infrastructure change is merged into the main repository without first undergoing automated checks for compliance rules. If the OPA command returns any violation, the pipeline fails and blocks code progression, safeguarding the production environment against operational slip-ups.

Final Thoughts on Governance and Continuous Evolution

Adopting automated infrastructure auditing with OPA and Rego transforms security from a bureaucratic bottleneck into a transparent, integrated process. By treating policies as code, companies gain the ability to audit changes with mathematical precision, maintaining regulatory compliance without sacrificing the delivery speed of technical teams. The secret to long-term success lies in ongoing collaboration between security, development, and operations teams, refining rules as new challenges and architectural scenarios emerge on the corporate horizon.