Policy as Code

Chapter 3. Policy as Code and Access Control

In Chapter 2, we discovered how OPA offers several operational modes to fit our different needs.  We explored Rego, the OPA policy language, and learned how it can be used for evaluation and reasoning of structured data.

Regardless of the system you operate, the application you support, or the data you maintain, access control is an essential component. In fact, access control is not an afterthought—at least, it shouldn’t be—when building new solutions. Access control determines who or what can perform operations in your systems, what operations they can perform, and when—under what circumstances or in what contexts—they can perform those operations.

Access control is divided into two main processes: authentication (AuthN) and authorization (AuthZ). AuthN is used to determine that users or systems are who they claim to be and provide proof in the form of identity principals and attributes. Once identity is verified, AuthZ is used to decide what privileges an actor has within a system.

In this chapter, we start with a primer on privileged access management, why it exists, and the types of PAM that are commonly used. I will introduce you to role-based and attribute-based access control models, and show you how PaC can be used with these models to provide more dynamic AuthZ services. We will also explore tooling that reduces the operational burden of managing policy engines and the artifacts used by them to make AuthZ decisions.

Privileged ...