DevSecOps › Module 9 › Lesson 2

BeginnerModule 9Lesson 2/5

Policy as Code

Policy as code literacy — OPA/Rego stub, CI gate rule, fail message, exception process, version pin — policy rows on YOUR `$DEVSEC_LAB` pipelines.

15 min+40 XP3 quiz

Module progress2 of 5

Visual · t36_policy_as_code

Policy as code = named gate rows. $DEVSEC_LAB. Original Cyberlium.

Opening

Manual review does not scale — name policy-as-code gate rows on YOUR lab pipelines before deploying sabotage policies to stranger org CI.

Policy as code literacy names: policy language stub category (OPA/Rego literacy), CI gate integration category, fail message clarity category, exception/override process category, and policy version pin category. Analyst documents policy-as-code card on `$DEVSEC_LAB` pipeline stub — one gate rule literacy, fail message, exception stub — without pushing policies to stranger org repos, without bypass gates on prod without ticket, without malicious policy that blocks legitimate security scans. Cyberlium teaches governance automation vocabulary — YOUR notes. Refused: stranger org policy deploy, prod gate bypass, sabotage policies. Lab row: policy-as-code card (gate rule, fail message, exception process, version pin).

1. Named policy rows

Policy language, CI gate, fail message, exception process, version pin — five literacy anchors.

Gate rule cites Module 6 Checkov or Module 7 Trivy threshold — same pipeline thread.

Command guide

Try these commands — Named policy rows

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

NIST SSDF RV.2 — https://csrc.nist.gov/Projects/ssdf GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions CISA Secure by Design — https://www.cisa.gov/securebydesign

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/findings/backlog.csv" <<'EOF'
finding_id,priority,scanner,asset,action,owner,status,due_date
DEVSEC-FND-001,P1,checkov,iac/main.tf,enable S3 public access block,platform,open,2026-09-05
DEVSEC-FND-002,P1,checkov,iac/main.tf,restrict SG SSH to RFC1918,platform,open,2026-09-05
DEVSEC-FND-003,P2,trivy,container/Dockerfile,pin alpine to current LTS,devops,open,2026-09-12
DEVSEC-FND-004,P2,trivy,container/Dockerfile,add non-root USER,devops,open,2026-09-12
DEVSEC-FND-005,P3,gitleaks,sample-repo,verify FAKE allowlist policy,sec_eng,backlog,2026-10-01
EOF

Command — copy this

grep -E 'DEVSEC-FND|checkov|trivy|gitleaks' "$DEVSEC_LAB/findings/backlog.csv"
python3 -c "print('Backlog: scan findings → prioritized remediation queue')"

Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF RV.2 (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Exception discipline

Exception process documented — time-bound override with owner stub.

Fail message readable for developer — not opaque deny.

3. Refused

No policy deploy to stranger orgs; no prod gate bypass; no sabotage policy recipes.

Policy literacy supports secure merge — not CI warfare.

4. What you ship: policy-as-code card

Gate rule + fail message + exception process + version pin + NEVER stranger org deploy line.

5. What you record before the next lesson

Policy-as-code card path.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Push malicious OPA policy to stranger org public repo CI as 'policy-as-code demo.'
Right
Policy-as-code card from `$DEVSEC_LAB` pipeline stub. Next: Secure Merge.

Mission: policy-as-code card

1) Name five policy literacy rows. 2) One gate rule for lab pipeline. 3) Fail message and exception stub. 4) Write NEVER stranger org deploy line.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “Exception process — minimum literacy stub?”

Knowledge Check

APPLY: Policy as code literacy uses:

Multiple choice

Knowledge Check

APPLY: True or False: Deploying policies to stranger org CI is course lab.

True or False

Knowledge Check

APPLY: Policy card includes:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP