Policy as Code

Preface

In 2016, I was tasked with writing cloud computing controls as part of a large cloud-migration effort. These controls were based on standards adopted by—and created within—our organization, and they prevented unwanted and potentially dangerous changes within our cloud environments. I started writing the controls using what I thought was the best tool in my toolbox, Java; I was a Java subject matter expert (SME), and the cloud service provider (CSP) offered a mature Java software development kit (SDK).

The first and, as it turns out, last control I wrote in Java enforced encryption of data at rest on object storage. There are certain control types within cloud computing that I consider fundamental for secure computing, and encryption of data at rest and data in transit tops my list.

I quickly realized that building and running individual programs or modules to implement controls for the vast collection of cloud computing services and their respective features was not scalable or easily supportable. Writing code to consume the SDK was too low level. I was moving too slow, and it was challenging for me to share my approach in a way that facilitated broad adoption. The standards and controls SMEs were not Java programmers, and I couldn’t expect them to learn Java just to build new controls or even support those already built.

I Needed Policy as Code

I needed a more abstract solution—maybe underpinned by a domain-specific language (DSL)—that provided a common lexicon that ...