Docs / Building infrastructure
Policy
The rules that read every plan before anyone is asked to approve it.
Policy runs with Open Policy Agent on the machine-readable plan, in the same run that produced it, on create, change and destroy plans alike. Each finding has a severity.
| Severity | Effect |
|---|---|
| Block | The plan cannot be approved. The service refuses an approval even if one is sent. |
| Warn | Allowed, but worth reading before you approve. |
| Info | Recorded for the reviewer. No action needed. |
The rules
| Area | Rule | Severity |
|---|---|---|
| Network | A security group admits every protocol from the internet | Block |
| Network | A security group opens an administrative port to the internet | Block |
| Network | A security group opens a wide port range to the internet | Block |
| Network | A security group is reachable from the internet | Warn |
| Network | The Kubernetes API is reachable from the whole internet | Warn |
| Network | The Kubernetes API is public and the plan does not say who may reach it | Warn |
| Network | The Kubernetes API is public | Info |
| Data | A bucket’s public-access guard is being switched off | Block |
| Data | A bucket is being given a public ACL | Block |
| Data | A disk, or the disks nodes launch with, would be unencrypted | Block |
| Data | A database is being created unencrypted | Block |
| Data | A database is being given a public address | Block |
| Data | Instance metadata can be read without a session token | Warn |
| Identity | A policy grants every action on every resource | Block |
| Identity | A policy allows everything except a named list | Block |
| Identity | A policy grants a whole service on every resource | Warn |
| Identity | A role can be assumed by any AWS account | Block |
| Identity | A bucket policy grants access to everyone | Block |
| Cluster | The plan moves Kubernetes to an earlier version | Block |
| Cluster | The plan skips a Kubernetes minor version | Block |
When policy cannot run
If the policy step produced nothing SysJ can read, the plan carries a blocking finding saying it has not been checked. An unchecked plan is never approvable. Ask for the plan again.