Gate infrastructure with policy-as-code: evaluate the Terraform plan JSON with OPA/Conftest (or Sentinel) to reject misconfigurations — public exposure, wildcard IAM, missing tags, unencrypted resources — before apply, preventively.
Installs into .claude/skills of the current project.
Are you the author of Policy As Code Iac?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-policy-as-code-iac)
---
name: policy-as-code-iac
description: "Gate infrastructure with policy-as-code: evaluate the Terraform plan JSON with OPA/Conftest (or Sentinel) to reject misconfigurations — public exposure, wildcard IAM, missing tags, unencrypted resources — before apply, preventively."
---
# Policy-as-Code for IaC
## Evaluate the plan
Run `terraform plan -out` -> `terraform show -json` -> evaluate with **OPA/Conftest** (or Sentinel). Fail the pipeline on violations **before apply**.
## Common guardrails
- No public storage / `0.0.0.0/0` to admin ports
- No wildcard IAM (`*` action/resource)
- Required tags present
- Encryption at rest enabled
## Preventive > detective
Blocking the misconfigured plan beats auditing the breached resource later. Route the security **verdict** to `security-engineering`; the gate just enforces the rule.
