Policy as code

A policy that lives in a document is enforced by whoever remembers it. A policy that lives in code is enforced by the pipeline, evaluated continuously, and evidenced automatically.

The standard. Automated resource inventory, configuration history and configuration-change notification, so security and governance rules are enforced continuously rather than reviewed periodically.

What is enforced

Data security

Encryption of sensitive data at rest and in transit across S3, EBS, RDS, EFS and messaging services.

Access control

Least-privilege IAM, no long-lived access keys, MFA for console access, no wildcard actions.

Governance

Mandatory tagging, approved regions, approved account structure, no public buckets.

Compliance

Control mapping for SOC 2, ISO 27001, CIS Benchmarks, PCI-DSS and HIPAA where applicable.

Logging and monitoring

CloudTrail enabled everywhere, VPC Flow Logs on, Config recording on, centralised log archive.

The control layers

Policies are applied at four points, each catching what the previous layer misses.

Layer	Mechanism	When it acts	Best for
Prevent	AWS Organizations SCPs	Before an API call completes	Hard limits: region restrictions, service denials, protection of logging
Prevent	IAM permission boundaries and roles	At authorisation	Maximum permissions a principal can hold
Detect and remediate	AWS Config rules with remediation	Continuously, after change	Configuration drift, encryption, tagging, public access
Detect	Security Hub, GuardDuty, Prowler	Continuously	Posture against standards, threat detection, third-party assessment
Pre-deploy	Terraform scan, CloudFormation Guard	In the pipeline	Catching violations before they exist

A control implemented only at the detection layer is a control that allows the violation and then reports it. Use prevention where the cost of a violation is unacceptable, and detection where remediation is safe.

AWS Config

Config records resource configuration history and evaluates rules against it.

Enabling

• Record all resource types in every governed region.
• Deliver configuration snapshots and history to a centralised S3 bucket in the log archive account.
• Aggregate findings to the organisation account using an aggregator.
• Enable conformance packs for baseline standards.

Rule categories

Domain	Example rules
Encryption	encrypted-volumes, s3-bucket-server-side-encryption-enabled, rds-storage-encrypted, efs-encrypted
Network	restricted-ssh, vpc-sg-open-only-to-authorized-ports, vpc-flow-logs-enabled
Public access	s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited
Identity	iam-root-access-key-check, iam-password-policy, mfa-enabled-for-iam-console-access
Logging	cloud-trail-enabled, cloudwatch-log-group-encrypted, multi-region-cloud-trail-enabled
Tagging	required-tags with Owner, Project, CostCenter, DataClassification
Availability	rds-multi-az-support, autoscaling-group-elb-healthcheck-required

Remediation

Automatic remediation is applied where the correct state is unambiguous — enabling encryption, adding a required tag, removing a public ACL. Where remediation could cause an outage, the rule sends a notification and a runbook link instead.

# Remediation pattern: SSM Automation document triggered by a Config rule
Resources:
  RemediatePublicBucket:
    Type: AWS::Config::RemediationConfiguration
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      TargetType: SSM_DOCUMENT
      TargetId: AWSConfigRemediation-RemoveManagerPublicAccess
      Automatic: false
      MaximumAutomaticAttempts: 3
      RetryAttemptSeconds: 300

Automatic: false is deliberate for anything that changes customer-visible behaviour. The finding routes to a human with a documented action rather than an unexplained change.

CloudFormation Guard

Pre-deployment validation evaluates templates and Terraform plans against rules before anything is created.

# guard rule: every S3 bucket must have versioning and encryption
rule s3_buckets_are_protected {
  Resources.*[ Type == 'AWS::S3::Bucket' ] {
    Properties.BucketEncryption exists
    Properties.VersioningConfiguration.Status == 'Enabled'
    Properties.PublicAccessBlockConfiguration.BlockPublicAcls == true
  }
}

A failing rule blocks the pipeline. The rule document is versioned alongside the infrastructure code and reviewed like code.

Tagging as a policy

Tagging is enforced, not requested.

Tag	Required	Enforcement
Environment	Yes	SCP denies creation without it in production OUs
Project	Yes	Config rule, non-compliant finding
Owner	Yes	Config rule; required for incident routing
CostCenter	Yes for billable resources	Config rule; feeds cost allocation
DataClassification	Yes for data stores	Config rule and review gate

Evidence

Policy as code produces continuous evidence rather than a periodic audit pack:

• Config compliance dashboard per account and per rule.
• Security Hub score against enabled standards.
• Prowler scan results for the current period.
• Change history from Config, exportable for an auditor.
• Pipeline logs showing policy gates passed before deployment.

Related standards

• AWS Config compliance
• Service control policies
• Detection
• Terraform standard