Creating Policy-as-Code Governance Rules

A Policy-as-Code governance rule allows you to define custom compliance and security policies that Firefly will enforce across your cloud infrastructure. These rules help ensure your cloud resources adhere to your organization's standards, security requirements, and best practices. Once created, Firefly will continuously evaluate your infrastructure against these policies and flag any violations, helping you maintain governance at scale.

How to add a Policy-as-Code governance rule:

Open Policy settings: In the Firefly app, go to Settings > Policies. This section allows you to manage all your governance policies.
Add a new policy: Click on "+ Add policy." This will start the wizard to create a custom governance policy.
Name and describe the policy: Give the policy a clear Name and an optional Description so you and your team understand its purpose. For example, "Ensure all S3 buckets are encrypted" could be a policy name.
(Optional) Label the policy: You can assign a label or category to the policy (or create a new label) to help organize multiple policies. This is useful if you have many policies and want to filter or group them by compliance framework (e.g., CIS, SOC2) or by team.
Choose the scope: Click Next, then select the scope of the policy. The scope determines which resources the policy will evaluate. It could be specific cloud accounts, regions, resource types, or a combination. For example, you might scope the policy to only AWS accounts or specifically to S3 buckets.
Define the policy logic: In the provided code editor, write the policy logic using the Rego policy language (the language used by Open Policy Agent). Firefly uses Rego to define custom rules. For instance, you could write a Rego expression that checks if encryption is enabled on storage resources or if specific tags are present. (Firefly will provide templates or examples in the editor to help get you started.)
Preview policy evaluation: Before finalizing, you can preview which resources would violate this policy. Use the preview option to see a list of resources that currently fail to meet the policy criteria. This helps validate that your policy is correctly identifying non-compliant resources.
Save the policy: Click Next and then Done to create the policy. The policy will be activated, and Firefly will begin evaluating your infrastructure against it.

After creating a policy, you can view violations in the Governance dashboard. Each violation will show which resource failed the policy check and why, allowing you to take corrective action. If needed, you can always disable or delete the policy later via the Settings > Policies page.

When to create custom Policy-as-Code rules:

Creating custom governance policies is valuable in several scenarios:

Industry-specific compliance: If your organization must adhere to specific regulations (like HIPAA, PCI-DSS, or GDPR), you can create policies that enforce those requirements across your cloud infrastructure.
Internal security standards: Enforce your organization's security best practices, such as requiring MFA for all IAM users, preventing public access to sensitive resources, or ensuring proper encryption settings.
Cost optimization: Create policies that identify wasteful resources, such as oversized instances, unused volumes, or resources without proper lifecycle management.
Tagging and organization: Ensure all resources follow your tagging strategy by creating policies that check for required tags or naming conventions.
Architecture standards: Enforce architectural best practices, such as requiring multi-AZ deployments for production databases or preventing the use of deprecated services.
Custom guardrails: Create policies that prevent specific actions or configurations that pose risks to your environment, such as opening broad security group rules or creating resources in unapproved regions.

By implementing Policy-as-Code governance rules, you can automate compliance checking, reduce manual auditing efforts, and catch potential issues before they become problems. This proactive approach to governance helps maintain security and compliance at scale while still allowing teams to move quickly.

PreviousPolicy & Governance NextRemediating Policy Violations

Last updated 1 month ago

Was this helpful?

How to add a Policy-as-Code governance rule:

Open Policy settings: In the Firefly app, go to Settings > Policies. This section allows you to manage all your governance policies.

Add a new policy: Click on "+ Add policy." This will start the wizard to create a custom governance policy.

Name and describe the policy: Give the policy a clear Name and an optional Description so you and your team understand its purpose. For example, "Ensure all S3 buckets are encrypted" could be a policy name.

(Optional) Label the policy: You can assign a label or category to the policy (or create a new label) to help organize multiple policies. This is useful if you have many policies and want to filter or group them by compliance framework (e.g., CIS, SOC2) or by team.

Choose the scope: Click Next, then select the scope of the policy. The scope determines which resources the policy will evaluate. It could be specific cloud accounts, regions, resource types, or a combination. For example, you might scope the policy to only AWS accounts or specifically to S3 buckets.

Define the policy logic: In the provided code editor, write the policy logic using the Rego policy language (the language used by Open Policy Agent). Firefly uses Rego to define custom rules. For instance, you could write a Rego expression that checks if encryption is enabled on storage resources or if specific tags are present. (Firefly will provide templates or examples in the editor to help get you started.)

Preview policy evaluation: Before finalizing, you can preview which resources would violate this policy. Use the preview option to see a list of resources that currently fail to meet the policy criteria. This helps validate that your policy is correctly identifying non-compliant resources.

Save the policy: Click Next and then Done to create the policy. The policy will be activated, and Firefly will begin evaluating your infrastructure against it.

When to create custom Policy-as-Code rules:

Creating custom governance policies is valuable in several scenarios:

Industry-specific compliance: If your organization must adhere to specific regulations (like HIPAA, PCI-DSS, or GDPR), you can create policies that enforce those requirements across your cloud infrastructure.

Internal security standards: Enforce your organization's security best practices, such as requiring MFA for all IAM users, preventing public access to sensitive resources, or ensuring proper encryption settings.

Cost optimization: Create policies that identify wasteful resources, such as oversized instances, unused volumes, or resources without proper lifecycle management.

Tagging and organization: Ensure all resources follow your tagging strategy by creating policies that check for required tags or naming conventions.

Architecture standards: Enforce architectural best practices, such as requiring multi-AZ deployments for production databases or preventing the use of deprecated services.

Custom guardrails: Create policies that prevent specific actions or configurations that pose risks to your environment, such as opening broad security group rules or creating resources in unapproved regions.