Policy-as-Code expresses security, compliance, and operational rules as version-controlled code that is automatically enforced — for example OPA/Rego, Kyverno, or AWS SCPs gating deploys and admissions.

Detailed Answer

Instead of manual reviews or wiki policies, rules become testable, reviewable, automated gates: admission controllers reject non-compliant Kubernetes objects, CI fails IaC that violates policy (conftest), and cloud guardrails (SCPs) constrain accounts. This scales governance consistently and provides an audit trail, shifting compliance left.

💡

Interview Tip

Give concrete engines (OPA/Rego, Kyverno, SCPs) and where they enforce (admission, CI) — specificity signals hands-on use.

policy-as-codeopagovernance

What is Policy-as-Code?

More DevOps Fundamentals questions