# Policies & Compliance

Source: https://docs.ops0.com/docs/policies/overview

Define and enforce infrastructure policies across Terraform, Ansible configurations, and Kubernetes clusters. ops0 evaluates policies before every deployment, enforces Kyverno rules on clusters, and tracks violations in the compliance dashboard.

---

## Policy Types

The Policies page organizes policies into tabs by infrastructure type:

| Tab | Engine | Applies to |
|-----|--------|------------|
| **IaC Policies** | OPA / Rego | Terraform, OpenTofu, Oxid, CloudFormation deployments |
| **Configuration Policies** | OPA / Rego | Ansible configuration project deployments |
| **Kubernetes Policies** | Kyverno (YAML) | Kubernetes clusters at admission time |

IaC and Configuration policies share the same OPA/Rego engine. Kubernetes policies are a separate type using Kyverno YAML and are enforced by the Kyverno controller running in the cluster.

---

## Severity Levels

| Severity | Behavior |
|----------|----------|
| **Error** | Blocks deployment — deployment enters `policy_blocked` status |
| **Warning** | Non-blocking — violation is recorded and counted in compliance metrics |
| **Info** | Advisory only — shown in results but has no enforcement effect |

The **blocking level** configured in [Settings → Compliance](https://docs.ops0.com/docs/settings/compliance) controls which severities actually block a deployment. For example, setting blocking level to **Warning** means both `error` and `warning` violations stop the apply from running.

---

## Policy Categories

| Category | Example Rules |
|----------|---------------|
| **Security** | S3 encryption required, no public IPs on databases, security groups restricted |
| **Cost** | Instance size limits, no expensive instance types |
| **Compliance** | Resources in approved regions only, encryption at rest |
| **Tagging** | Required tags (Owner, Environment, CostCenter), naming conventions |
| **Best Practices** | Industry standards and conventions |
| **Custom** | User-defined policies for any scenario |

---

## IaC Type Scoping

IaC policies can be scoped to a specific engine or applied to any:

| IaC Type | Description |
|----------|-------------|
| `terraform` | Only evaluated for Terraform projects |
| `opentofu` | Only evaluated for OpenTofu projects |
| `oxid` | Only evaluated for Oxid projects |
| `cloudformation` | Only evaluated for CloudFormation projects |
| `any` | Evaluated regardless of IaC engine (default) |

Use `cloudformation` scoping for policies that check AWS CloudFormation template syntax — these are evaluated against the template JSON rather than a Terraform plan.

---

## Policy Execution Engine

IaC and Configuration policies run through the OPA (Open Policy Agent) execution pipeline:

1. The Terraform plan JSON (or configuration state) is passed as `input` to the OPA evaluator
2. ops0 extracts the Rego `package` name from the policy code
3. OPA is invoked as `opa eval data.<package>.deny` and `data.<package>.warn`
4. Deny messages become Error-severity violations; warn messages become Warning-severity violations
5. The blocking level setting determines whether the deployment is stopped

**Package names matter**

Each Rego policy must declare a unique `package` name (e.g., `package ops0.terraform.s3`). ops0 uses this package name to query the correct rule. Policies with identical package names in the same project will collide — use descriptive, unique names.

---

## AI Policy Generation

Generate policies automatically from natural language.

### Describe what you need
Enter a prompt: *"Block any S3 bucket without encryption in production accounts."*

### Select parameters
Choose the category and severity level.

### Review generated code
ops0 produces complete Rego code or Kyverno YAML you can edit before saving.

### Save and activate
Save the policy and assign it to projects or policy groups.

**Requires AI configuration**

AI policy generation requires a Claude API key configured in **Settings → API Configuration**.

---

## Policy Groups

Organize policies into named groups and attach groups to projects at scale.

| Field | Description |
|-------|-------------|
| **Name** | Human-readable group name |
| **Type** | `iac`, `configurations`, or `kubernetes` |
| **Enabled** | Toggle all policies in the group at once |
| **Policies** | Policies included in the group |
| **Projects** | Projects this group is mapped to |

### How Groups Work

- Create a group and add policies to it
- Map the group to one or more projects
- All policies in the group apply to every mapped project
- Toggle the group on/off to enable/disable all its policies at once

### Effective Policies

A project's effective policies are the union of:
- Policies directly mapped to the project
- Policies inherited from all policy groups mapped to the project

View at **Policies → By Project → [select project]**.

### Framework-Imported Groups

When you import a compliance framework, ops0 creates a policy group containing all the framework's built-in policies. These built-in policies (marked `is_builtin`) cannot be edited individually, but you can edit the group name, enable/disable the group, and add or remove projects.

If you delete a framework-imported group, ops0 automatically deletes any built-in policies that belong only to that group (orphan cleanup). Built-in policies that are shared across multiple groups are not deleted.

---

## Policy Templates

ops0 includes a library of built-in policy templates covering common security, cost, compliance, tagging, and best-practice scenarios, organized into the same three tabs as the Policies page — Infrastructure as Code, Configurations, and Kubernetes. Import a template to create an editable copy rather than writing from scratch.

![ops0 Policy Templates library showing IaC, Configurations, and Kubernetes template categories](https://docs.ops0.com/images/policies-templates.png)

| Category | Examples |
|----------|---------|
| **Infrastructure as Code** | S3 encryption, no public access, security group rules, instance size limits, tagging requirements |
| **Configurations** | Ansible hardening, idempotency, and best-practice checks |
| **Kubernetes** | Kyverno-based pod security, resource limits, and image policy checks |

### Browse Templates
Go to **Policies → Templates** to view the library.

### Preview
Review the Rego code and description.

### Import
Click **Import** to create a new editable policy from the template.

---

## Compliance Frameworks

Import pre-built compliance frameworks that map industry standards to ops0 policies. Each framework contains controls with full Rego code written against the specific cloud provider's Terraform resources.

### Available Frameworks (38 total)

**AWS (12 frameworks)**

| Framework | Terraform variant | CloudFormation variant |
|-----------|------------------|----------------------|
| CIS AWS Foundations | ✓ | ✓ |
| SOC 2 for AWS | ✓ | ✓ |
| HIPAA for AWS | ✓ | ✓ |
| GDPR for AWS | ✓ | ✓ |
| ISO 27001 for AWS | ✓ | ✓ |
| ISO 27002 for AWS | ✓ | ✓ |

**Azure, GCP, Oracle Cloud (6 frameworks each)**

CIS, SOC 2, HIPAA, GDPR, ISO 27001, ISO 27002 — available for each provider.

**Kubernetes (3 frameworks)**

| Framework | Description |
|-----------|-------------|
| CIS Kubernetes Benchmark | CIS controls for Kubernetes cluster hardening |
| NSA Kubernetes Hardening | NSA/CISA Kubernetes Hardening Guidance |
| Pod Security Standards (PSS) | Kubernetes Pod Security Standards |

**Configuration Management (2 frameworks)**

| Framework | Description |
|-----------|-------------|
| CIS Ansible Benchmark | CIS controls for Ansible configuration hardening |
| STIG Ansible | DISA STIG compliance checks for Ansible |

**CloudFormation variants**

AWS frameworks have separate Terraform and CloudFormation variants. The CloudFormation variant evaluates policies against CloudFormation template JSON instead of a Terraform plan. Select the correct variant when importing based on your IaC engine.

### View available frameworks
Go to **Policies → Frameworks** and select your cloud provider or platform.

### Preview controls
Review the framework's controls and each mapped Rego policy.

### Import framework
Importing creates a policy group with all framework policies pre-configured. Map that group to your projects to start enforcing.

---

## Kyverno Policies (Kubernetes)

For Kubernetes clusters, ops0 supports Kyverno policies written in YAML. Kyverno runs in the cluster and enforces policies at Kubernetes admission time.

| Feature | Description |
|---------|-------------|
| **Create / Import** | Write Kyverno YAML or import from templates |
| **Cluster Mapping** | Map policies to specific Kubernetes clusters |
| **Enforcement Modes** | `Enforce` (block violations) or `Audit` (log only) |
| **Toggle** | Enable/disable individual policies |
| **Validation** | Syntax validation before deployment |

### Diagnostics

The **Policy Diagnostics** modal shows Kyverno health on a cluster: installation status, deployed policies, enforcement modes, and webhook status.

---

## Policy Check History

View a full log of all policy evaluations across all projects at **Policies → Check History**:

- Which policy ran and whether it passed or failed
- The project and deployment that triggered the check
- Timestamps and violation details for failed checks
- Filterable by project, status (pass/fail), and date

---

## Example: Blocking an Insecure Deployment

### The Policy

```rego
package ops0.terraform.s3

deny[msg] {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_s3_bucket"
    not resource.values.server_side_encryption_configuration

    msg := sprintf(
        "S3 bucket '%s' must have encryption enabled",
        [resource.values.bucket]
    )
}
```

### Deployment Result

```
Policy Evaluation
─────────────────────────────────────
✗ FAILED — S3 Encryption Required (Error)

Violations:
  • S3 bucket 'company-data-bucket' must have encryption enabled

Deployment blocked. Fix violations and retry.
```

---

## Related

- [Creating Policies](https://docs.ops0.com/docs/policies/creating-policies): Write OPA/Rego and Kyverno policies with the policy editor.

- [Compliance Dashboard](https://docs.ops0.com/docs/policies/compliance): Monitor compliance posture and share reports.

- [Policy Checking](https://docs.ops0.com/docs/iac/deployments/policies): How policies are evaluated during IaC deployments.

- [Compliance Settings](https://docs.ops0.com/docs/settings/compliance): Configure enforcement scope, blocking levels, and default policy groups.