Policy enforcement level

As explained in Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform

A policy enforcement level specifies how strongly a policy violation must affect approval or deployment of a change.

A policy enforcement level defines how strongly a policy violation affects approval or deployment. It separates required controls from exceptions and guidance. section 8.3.4

Classify policies by their effect on the delivery pipeline:

• Hard mandatory: blocks production changes until the violation is fixed. section 8.3.4
• Soft mandatory: permits an exception only after manual analysis and approval. section 8.3.4
• Advisory: shares best practices without requiring correction before production. section 8.3.4

Firewall access exception

A firewall rule allowing 0.0.0.0/0 can be soft mandatory when public load balancers need endpoint access. A security team member reviews and approves the exception before production. section 8.3.4

Figure 8.9 You can divide policy as code into three enforcement categories that gate changes before production.

Use the enforcement-category figure to compare how policies gate changes before production. section 8.3.4

How Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform covers it

How deep it goes

Defines three enforcement categories and illustrates their pipeline consequences, without detailing policy implementation.

Examples

Uses database tagging, public firewall access, CIS benchmarks, Falco, and package-registry compliance as enforcement examples.

What it assumes

Assumes policy-as-code and security testing practices while distinguishing mandatory controls from exceptions and recommendations.

What you can do after

Operate policy checks by assigning blocking, review-based, or advisory treatment to individual controls.

How it connects

Connects policy as code with security testing, infrastructure configuration, exceptions, and delivery pipelines.

liveBookmanning.com

Read Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform on liveBook Get the book at manning.com

Related concepts

• policy enforcementconfigures · Policy enforcement is the application of defined rules and controls to permit, prevent, or constrain actions and behavior in accordance with requirements.

This explainer was generated by Manning's knowledge graph from the text of Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform. The section links point to the parts of the book it draws on.