<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-compliance-as-code
description: >-
  Implement compliance controls as automated tests using Open Policy Agent (OPA),
  InSpec, and Checkov custom policies. Map regulatory requirements to executable
  checks for continuous compliance validation against CIS, SOC 2, PCI DSS, and HIPAA.
domain: cybersecurity
subdomain: devsecops
tags:
  - compliance
  - opa
  - inspec
  - policy-as-code
  - cis-benchmarks
  - soc2
  - pci-dss
  - hipaa
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating Compliance as Code

## Overview

Compliance as Code translates regulatory requirements into executable policies that
run continuously in CI/CD pipelines. Instead of periodic manual audits, controls are
validated on every change. This skill covers writing OPA/Rego policies, InSpec profiles,
and Checkov custom checks mapped to CIS, SOC 2, PCI DSS, and HIPAA controls.

Mode: `[MODE: ARCHITECT]` — Compliance architecture with automated enforcement.

## Prerequisites

- Open Policy Agent (`brew install opa`)
- InSpec (`gem install inspec`)
- Checkov (`pip install checkov`)
- Conftest (`brew install conftest`)

## Key Concepts

### OPA/Rego Policy

```rego
# policy/kubernetes.rego
package kubernetes.admission

deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    container.securityContext.privileged == true
    msg := sprintf("Privileged container not allowed: %v", [container.name])
}

deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    not container.resources.limits.memory
    msg := sprintf("Memory limit required for container: %v", [container.name])
}

deny[msg] {
    input.request.kind.kind == "Deployment"
    not input.request.object.spec.template.spec.securityContext.runAsNonRoot
    msg := "Deployments must set runAsNonRoot: true"
}
```

### Conftest for CI/CD

```bash
# Test Kubernetes manifests
conftest test k8s/deployment.yaml -p policy/ --output json

# Test Terraform
conftest test main.tf -p policy/ --output json

# Test Dockerfile
conftest test Dockerfile -p policy/ --output json

# Pull community policies
conftest pull github.com/open-policy-agent/library
```

### InSpec Compliance Profile

```ruby
# controls/cis_aws.rb
control 'cis-aws-1.1' do
  impact 1.0
  title 'Avoid the use of root account'
  desc 'The root account has unrestricted access to all resources.'
  tag cis: '1.1'
  tag nist: ['AC-2']

  describe aws_iam_root_user do
    it { should_not have_access_key }
    its('mfa_enabled') { should be true }
  end
end

control 'cis-aws-2.1.1' do
  impact 1.0
  title 'S3 bucket encryption enabled'
  tag cis: '2.1.1'
  tag pci_dss: '3.4'

  aws_s3_buckets.bucket_names.each do |bucket|
    describe aws_s3_bucket(bucket) do
      it { should have_default_encryption_enabled }
    end
  end
end
```

### GitHub Actions Integration

```yaml
name: Compliance Checks
on: [pull_request]

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Conftest
        run: |
          wget -q https://github.com/open-policy-agent/conftest/releases/download/v0.50.0/conftest_0.50.0_Linux_x86_64.tar.gz
          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz
          sudo mv conftest /usr/local/bin/
      - name: Run policy checks
        run: |
          conftest test k8s/ -p policy/ --output json --all-namespaces
          conftest test terraform/ -p policy/ --output json
```

### Compliance Framework Mapping

| Control | CIS | SOC 2 | PCI DSS | HIPAA |
|---------|-----|-------|---------|-------|
| Encryption at rest | 2.1.1 | CC6.1 | 3.4 | §164.312(a)(2)(iv) |
| Access logging | 3.1 | CC7.2 | 10.1 | §164.312(b) |
| MFA for admins | 1.2 | CC6.1 | 8.3.1 | §164.312(d) |
| Network segmentation | 5.2 | CC6.6 | 1.3 | §164.312(e)(1) |
| Vulnerability scanning | — | CC7.1 | 11.2 | §164.308(a)(8) |

## Workflow

### Step 1: Validate Policies

```bash
node scripts/agent.js --action validate --policy-dir ./policy/ --output /tmp/policy-check.json
```

### Step 2: Run Compliance Scan

```bash
node scripts/agent.js --action scan --target-dir ./k8s/ --policy-dir ./policy/ --output /tmp/compliance.json
```

### Step 3: Generate Compliance Report

```bash
node scripts/agent.js --action report --target-dir . --output /tmp/compliance-report.json
```

## Verification

- [ ] OPA/Rego policies cover all critical controls
- [ ] Compliance checks run on every PR
- [ ] Policy violations block deployment
- [ ] Framework mappings documented (CIS, SOC 2, PCI DSS)
- [ ] InSpec profiles validate cloud infrastructure
- [ ] Exception process defined for policy waivers
- [ ] Compliance dashboard shows real-time posture

## References

- [Open Policy Agent](https://www.openpolicyagent.org/)
- [Conftest](https://www.conftest.dev/)
- [Chef InSpec](https://docs.chef.io/inspec/)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
