<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-compliance-as-code
description: >-
  Implement compliance-as-code pipelines using OPA/Rego, Terraform Sentinel,
  and InSpec to codify regulatory requirements as executable policies.
  Integrates with CI/CD for pre-deployment validation and post-deployment
  continuous assurance against multiple frameworks simultaneously.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - compliance-as-code
  - opa
  - rego
  - sentinel
  - inspec
  - policy-as-code
  - ci-cd
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Compliance as Code

## Overview

Compliance-as-code encodes regulatory requirements into machine-readable policies
that execute automatically in CI/CD pipelines and runtime environments. This
replaces manual checklist audits with deterministic, version-controlled, testable
compliance assertions using OPA/Rego for runtime decisions, Terraform Sentinel
for infrastructure provisioning gates, and InSpec for system-level verification.

Mode: `[MODE: ARCHITECT]` — Policy architecture with automated enforcement.

## Prerequisites

| Requirement | Install |
|---|---|
| OPA | `curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static` |
| InSpec | `gem install inspec` |
| Terraform | `apt install terraform` |
| Conftest | `brew install conftest` or binary from GitHub |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Policy Stack Architecture

```
Layer 4: Framework Mapping
  └── Maps policies to: PCI DSS, SOC 2, HIPAA, NIST 800-53
Layer 3: Organizational Policies (OPA/Rego)
  └── Encryption required, public access denied, tagging enforced
Layer 2: Infrastructure Policies (Sentinel/Conftest)
  └── Terraform plan validation before apply
Layer 1: System Policies (InSpec)
  └── Runtime configuration verification on deployed hosts
Layer 0: Evidence Collection
  └── Automated artifact gathering for audit evidence
```

### OPA Rego — Multi-Framework Policy

```rego
package compliance.encryption

import future.keywords.in

# Maps to: PCI DSS 3.4.1, NIST SC-28, SOC 2 CC6.1
violation[msg] {
    resource := input.resources[_]
    resource.type == "aws_ebs_volume"
    not resource.values.encrypted
    msg := sprintf(
        "EBS %s unencrypted [PCI 3.4.1, NIST SC-28, SOC2 CC6.1]",
        [resource.address]
    )
}

# Maps to: PCI DSS 4.2.1, NIST SC-8
violation[msg] {
    resource := input.resources[_]
    resource.type == "aws_lb_listener"
    resource.values.protocol != "HTTPS"
    msg := sprintf(
        "LB listener %s not HTTPS [PCI 4.2.1, NIST SC-8]",
        [resource.address]
    )
}

# Maps to: PCI DSS 1.3.1, NIST SC-7
violation[msg] {
    resource := input.resources[_]
    resource.type == "aws_security_group_rule"
    resource.values.cidr_blocks[_] == "0.0.0.0/0"
    resource.values.from_port <= 22
    resource.values.to_port >= 22
    msg := sprintf(
        "SG %s allows SSH from 0.0.0.0/0 [PCI 1.3.1, NIST SC-7]",
        [resource.address]
    )
}
```

### Conftest — Terraform Plan Validation

```bash
# Generate Terraform plan as JSON
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json

# Run compliance policies against plan
conftest test tfplan.json -p policies/ --output json

# Run with specific framework namespace
conftest test tfplan.json -p policies/ --namespace compliance.pci

# Verify Kubernetes manifests
conftest test deployment.yaml -p policies/k8s/ --output table
```

### CI/CD Integration

```yaml
# .github/workflows/compliance-gate.yml
name: Compliance Gate
on: [pull_request]
jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup OPA
        run: |
          curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static
          chmod +x opa && sudo mv opa /usr/local/bin/
      - name: Terraform Plan
        run: |
          terraform init && terraform plan -out=tfplan.binary
          terraform show -json tfplan.binary > tfplan.json
      - name: Policy Evaluation
        run: |
          conftest test tfplan.json -p policies/ --output json > results.json
          jq '.[] | select(.failures | length > 0)' results.json && exit 1 || true
      - name: Upload Evidence
        run: |
          node scripts/agent.js --action evidence \
            --input results.json --output /tmp/evidence.json
```

## Workflow

### Step 1: Initialize Policy Repository

```bash
node scripts/agent.js --action init --frameworks pci-dss,nist-800-53,soc2 \
  --output /tmp/cac-init.json
```

### Step 2: Evaluate Policies Against Infrastructure

```bash
node scripts/agent.js --action evaluate --plan tfplan.json \
  --policies ./policies/ --output /tmp/cac-eval.json
```

### Step 3: Generate Compliance Evidence Report

```bash
node scripts/agent.js --action evidence --input /tmp/cac-eval.json \
  --output /tmp/cac-evidence.json
```

## Verification

- [ ] OPA policies compile without errors (`opa check policies/`)
- [ ] Policy unit tests pass (`opa test policies/ -v`)
- [ ] Conftest validates Terraform plans in CI pipeline
- [ ] InSpec profiles execute on target systems
- [ ] Multi-framework mapping covers all applicable controls
- [ ] Evidence artifacts generated with timestamps and hashes

## References

- [Open Policy Agent](https://www.openpolicyagent.org/docs/)
- [Conftest](https://www.conftest.dev/)
- [Terraform Sentinel](https://developer.hashicorp.com/sentinel)
- [Chef InSpec](https://docs.chef.io/inspec/)
