Lion Cipher Lab

Write policy as code with OPA and Conftest: block the bad Terraform and the bad Kubernetes manifest before they ship

• Cloud Security
• Advanced
• ~75 min
• Free · no account required

Why it matters

A scanner like Checkov, Trivy or tfsec ships with hundreds of generic rules, and they are genuinely valuable — but they only know what is universally wrong. They do not know that at YOUR company every S3 bucket must carry an `owner` tag so the finance team can bill it and the on-call can page a human; that no security group outside the bastion module may open port 22 to the whole internet; that nothing in the prod namespace may run as root; that every image must be pinned to a digest because you were burned by a mutable tag once. Those rules exist at every organisation. The question is only…

What you'll learn

• policy as code
• writing Rego (the OPA policy language)
• Open Policy Agent (OPA) fundamentals
• Conftest against Kubernetes, Terraform and Dockerfiles
• reading a Terraform plan JSON
• unit-testing your own policies with conftest verify
• wiring policy checks into CI and pre-commit
• admission-control concepts (validating webhooks, Gatekeeper, Kyverno)
• designing exceptions, waivers and a warn-first rollout

Steps in this lab

1. The gap a scanner leaves — and why this lab exists
2. The four words you need: OPA, Rego, Conftest, and admission control
3. Install opa and conftest — pick the easiest path for your OS
4. Rego from absolute zero — play in the REPL before you write a file
5. Write your first rule, one line at a time, and evaluate it by hand
6. Policy 1: catch a deliberately terrible Kubernetes Deployment, then fix it
7. Policy 2: Terraform — and why you test the PLAN, not the source
8. Policy 3: a Dockerfile — proving this is a general config-testing tool
9. Unit-test the policies themselves — a buggy policy is worse than no policy
10. Ship it: CI, a pre-commit hook, and the enforcement ladder
11. The judgment: when to write your own, and how not to get your policy repo banned
12. Clean up, and the repository layout worth keeping

Open the full interactive lab →