Policy as Code and Infrastructure Compliance

AWS Cloud & DevOps Engineering · Lesson 35 · DevOps Automation and IaC

Lesson Overview

IaC accelerates mistakes as efficiently as it accelerates delivery. Policy as code encodes guardrails—no public S3, no 0.0.0.0/0 SSH, required tags, banned instance types—into automated checks that run in CI against Terraform plans, CloudFormation/CDK synth output, or live configuration. TechLearningPro pairs preventive controls (org SCPs as a tease, merge gates) with detective controls (AWS Config rules) and pipeline tools in the spirit of OPA/Conftest, CloudFormation Guard (cfn-guard), and Terraform policy tooling.

AWS Account Setup, IAM Identity Center and Organizations introduced multi-account thinking; SCPs return as hard boundaries later with Control Tower themes. This lesson makes compliance engineer-owned: write policies that reject public storage and permissive network rules before apply, and wire them into the same pipelines that plan Terraform or synth CDK.

Budget for Config recorders carefully in labs (they have cost dimensions—verify current pricing pages). Tag Project=tlp-lesson35. No secrets in policy repos. Clean up Config recorders/rules if you enable them only for the lab.

Learning Objectives

1. Explain preventive vs detective vs corrective compliance controls.
2. Tease SCPs as organization-level preventive guardrails (details deepen later).
3. Use AWS Config rules conceptually for drift/compliance on live resources.
4. Write cfn-guard style rules against CloudFormation/CDK synthesized templates.
5. Use OPA/Conftest-style policies against Terraform JSON plans or structured IaC.
6. Block PRs that introduce public buckets or wide-open security groups.
7. Distinguish policy-as-code from vulnerability scanning of app dependencies.
8. Design exceptions with expiry and owners—not infinite ignore.
9. Integrate checks into GitHub Actions / CodeBuild without inventing undocumented actions.
10. Report compliance evidence for audits with CI artifacts.
11. Avoid duplicate contradictory policies across tools.
12. Budget and clean up Config-related lab resources.
13. Connect to Well-Architected security/cost lenses.
14. Prepare Module 4 observability to alert on compliance regressions.
15. Close Module 3 IaC story: ship fast, ship constrained.

Prerequisites

• Lessons 29–34 IaC and deployment.
• IAM and Organizations teasers from foundations.
• AWS Well-Architected Framework and Cost Basics.
• CI lessons 26–28.
• Budget alert; willingness to read current tool docs for CLI syntax.

Detailed Core Concepts

Why policy as code

Human review misses YAML one-liners that open buckets. Automated policies scale. They also document intent: “we forbid public ACLs” becomes a tested rule, not a wiki myth.

Control types

• Preventive: SCP denies, IAM boundaries, merge blocked on failed Conftest/cfn-guard.
• Detective: Config rules, Security Hub aggregations (awareness), drift detection.
• Corrective: automation remediations—use carefully; auto-delete can surprise.

SCP tease

Service Control Policies limit what accounts in an Organization can do even if IAM allows it. Example intent: deny leaving regions, deny disabling CloudTrail. Deep landing-zone design comes in advanced modules—today know SCPs exist above IAM.

AWS Config

Recorder + rules evaluate resources against desired conditions (managed rules or custom). Good for detecting public buckets that slipped past CI or were changed in console. Cost: configuration items and rule evaluations—do not leave verbose recorders in unused regions from a forgotten lab.

cfn-guard

Policy language for CloudFormation templates. CDK synth → template → cfn-guard validate. Ideal CDK-aligned gate.

OPA / Conftest

Rego policies test JSON/YAML. Terraform plan -out → show -json → Conftest. Express “SG ingress cidr must not be 0.0.0.0/0 on port 22.”

Terraform-specific policy tools

HashiCorp Sentinel (enterprise) and open tools in the ecosystem exist—evaluate what your org licenses. Concepts transfer: fail the build on violation.

Exceptions

Break-glass public demo bucket needs ticket, owner, expiry date, and policy allowlist keyed to ARN—not commenting out the rule globally.

Architecture and Design Diagrams

mermaidCopy
flowchart TB
  Dev[Developer PR]
  Synth[Terraform plan JSON / CDK synth]
  Pac[OPA Conftest / cfn-guard]
  Merge{Pass?}
  Apply[Apply / Deploy]
  Config[AWS Config detective]
  SCP[SCP preventive org]

  Dev --> Synth --> Pac --> Merge
  Merge -->|yes| Apply
  Merge -->|no| Dev
  Apply --> Config
  SCP -.-> Apply

Technical Explanation

Example policy intents (language-agnostic)

1. S3 buckets must block public access configuration.
2. Security groups must not allow SSH/22 from 0.0.0.0/0 or ::/0.
3. Required tags: Project, Environment, Owner.
4. Deny creation of unrestricted IAM Action: * on Resource: * in tenant policies when detectable.

Implement in Rego or Guard syntax per current tool docs—course refuses frozen unverified rule file syntax as gospel; your lab must validate against the tool version you install.

CI sketch

yamlCopy
# Conceptual GitHub Actions steps — verify actions and commands you use
# - terraform plan -out tfplan && terraform show -json tfplan > plan.json
# - conftest test plan.json
# - cdk synth && cfn-guard validate --data cdk.out/... --rules rules/

Fail the job non-zero on violations.

Performance

Policies should run in seconds on plans; avoid downloads of huge frameworks each job without caching.

Security of policy repos

Protect who can change policies—CODEOWNERS. A malicious policy weaken is an attack.

Practical Implementation or Design Walkthrough

Problem

Write policies rejecting public storage and permissive SSH network rules; run them against a deliberately bad template/plan and a fixed one in CI-like local runs.

Steps

1. Budget alert; decide if Config lab is in scope or CI-only.
2. Author rules for S3 public and SG 22 open.
3. Create violating fixture; show fail.
4. Create compliant fixture; show pass.
5. Optional: enable a managed Config rule in one region; observe; disable/cleanup.
6. Document exception process.
7. ADR: preventive CI + detective Config + future SCPs.

Enterprise Real-World Scenarios

Policy only in wiki

Nobody reads it; public bucket ships. Fix: CI gates.

Config without CI

Find issues after exposure. Fix: both preventive and detective.

Exception forever

# noqa permanent. Fix: expiry.

Conflicting tools

Guard allows what OPA denies. Fix: single source of intent.

SCP too tight in sandbox

Breaks labs. Fix: separate sandbox OU policies.

Best Practices

1. Preventive in CI + detective in AWS.
2. CODEOWNERS on policies.
3. Fixtures for pass/fail tests of policies themselves.
4. Exceptions with expiry.
5. Map rules to threat stories.
6. Keep rules readable.
7. Align with SCPs later—do not contradict.
8. Budget Config.
9. Artifact policy results for audits.
10. Do not duplicate 200 overlapping rules.
11. Educate engineers with clear violation messages.
12. Version policies.
13. Run on synth/plan before apply.
14. Tag everything for ownership.
15. Review weaken PRs like IAM PRs.

Common Mistakes and Anti-Patterns

1. Wiki-only compliance.
2. Only detective controls.
3. Infinite exceptions.
4. Unclear violation errors.
5. Policies not tested.
6. Leaving Config on in all regions accidentally.
7. Letting everyone edit policy repos.
8. Blocking without teaching fixes.
9. Inventing cloud APIs in policies that do not match schema.
10. Treating policy pass as full security program.

Troubleshooting and Design Review

Interview Questions and Answers

Q1: Policy as code? A: Automated, versioned guardrails on infra changes/config.
Q2: Preventive vs detective? A: Stop before apply vs detect after.
Q3: SCP? A: Org-level permission guardrail above accounts.
Q4: Config? A: Evaluate resource compliance continuously.
Q5: cfn-guard? A: Rules on CloudFormation templates.
Q6: OPA/Conftest? A: General policy engine on JSON/YAML (plans).
Q7: Why CI? A: Shift left before exposure.
Q8: Exceptions? A: Time-bounded, owned, recorded.
Q9: vs app SCA? A: Infra posture vs library CVEs—both needed.
Q10: Dual control? A: CI + Config + SCP layers.
Q11: Who owns policies? A: Platform/security with engineer input.
Q12: Measuring success? A: Violations blocked; MTTM for detective findings.
Q13: CDK relation? A: Guard on synth output.
Q14: Terraform relation? A: Conftest on plan JSON.
Q15: Module 3 close? A: Fast delivery constrained by encoded policy.

Hands-On Exercises

Exercise: Policies that reject public storage and permissive network rules

Deliver pass/fail fixtures, CI command transcript, optional Config evidence, exception ADR snippet, cleanup.

Challenge ADR

Leadership wants only Security Hub monthly reviews. Argue for shift-left policy as code with detective backup.

Lab evidence checklist

Failing run, passing run, rule text, CODEOWNERS note, Config cleanup if used.

Narrative: public notes bucket

Learner PII risk from public lecture notes bucket; Guard rule would have blocked; Config found a console sibling; SCP later denies s3 public broadly.

Continuity

Module 4 begins with CloudWatch—alarms that your canaries and compliance findings will need.

Writing the public S3 denial intent clearly

Policy should fail when public ACL, public policy, or block public access disabled appears—depending on resource representation in the template/plan. Fixtures must include a bad bucket and a good bucket. Engineers should receive a message that says how to fix (BlockPublicAccess configuration), not only FAIL.

Remember console-created buckets bypass CI—Config detective rules catch those. Pair them.

Writing the SSH 0.0.0.0/0 denial intent

Inspect security group ingress for port 22 (and 3389) with open CIDRs. Allow exceptions for break-glass with explicit CIDR allowlists that still are not the whole internet. Prefer SSM, so exceptions should be rare and ticketed.

Rego/Conftest workflow discipline

terraform show -json tfplan > plan.json then conftest test plan.json. Pin Conftest version. Store policies in policy/ with README examples. Unit-test policies by running against fixtures in CI—the policies are code and can regress.

cfn-guard workflow discipline

cdk synth then validate templates in cdk.out. Mind that nested stacks/assets may produce multiple templates—validate all that matter. Keep rules in version control beside the app or in a central security repo consumed as a versioned dependency.

SCP tease scenarios for TechLearningPro

Deny leaving the approved regions; deny disabling GuardDuty/Config/CloudTrail once enabled in prod OUs; deny unrestricted IAM user creation in workload accounts. Sandboxes may be looser. Exact SCP JSON belongs in later landing-zone lessons—today write the intents in your ADR.

AWS Config lab caution

Recorders produce configuration items billed per current pricing. Enable in one region, one account, short window; use a managed rule like restricted SSH or S3 public access; capture a compliant/noncompliant screenshot; turn off or delete lab recorder/rules to avoid surprise bills. Verify deletion.

Exception registry design

A YAML/JSON registry listing resource ARN patterns, rule IDs, expiry, owner, ticket link. CI policy loads allowlist. Monthly job fails if expiry passed. This is how enterprises avoid infinite # ignore.

Policy messages as teaching tools

Bad: violation. Good: Security group sg ingress allows tcp/22 from 0.0.0.0/0. Prefer SSM Session Manager (course lesson 20). If break-glass required, request exception with expiry. Your future teammates will thank you.

Dual pipeline gates

Require policy pass on PR and again on main before apply—protect against force merges that skip PR checks when admins panic. Branch protection is part of policy as code’s social layer.

Mapping to Well-Architected

Security pillar: preventive controls. Operational excellence: encoded runbooks as rules. Cost: deny huge instance families in sandbox. Reliability: require multi-AZ markers for prod ALBs when detectable. Performance: rarer in static policy—do not force awkward rules.

Module 3 closing narrative

Git → CI → plan/synth → policy → apply → deploy strategy → detect with Config. That chain is TechLearningPro’s DevOps Automation and IaC spine. Module 4 makes the signals loud with CloudWatch.

Interview story to memorize

“We blocked a public notes bucket in CI with Guard, caught a console twin with Config the same week, and later SCP-denied public S3 in prod OUs.” Three layers, one threat story.

Extended practice scenario 1 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 2 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 3 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 4 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 5 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 6 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 7 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 8 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 9 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 10 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 11 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 12 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 13 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 14 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 15 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 16 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 17 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 18 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 19 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 20 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 21 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 22 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 23 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 24 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 25 — 35 policy as code and infrastructure compliance

In a timed drill, implement or design the core lab for 35 policy as code and infrastructure compliance with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Compliance evidence pack for auditors

TechLearningPro should store CI artifacts that show policy version, commit SHA, pass/fail output, and the plan/synth hash evaluated. Auditors ask “was this change reviewed against controls?”—a green checkbox without artifacts is weak. Retain artifacts per your retention policy; redact account IDs if needed in shared classrooms.

Pair detective Config snapshots with the preventive CI evidence for the same week to show defense in depth. When an exception is active, the artifact should include the exception ID and expiry so auditors do not treat silence as approval.

Lesson Summary

Policy as code turns TechLearningPro’s infrastructure standards into enforceable checks: cfn-guard and OPA/Conftest in CI, Config for detection, SCPs as organizational prevention teased for later depth. Write rules that block public storage and reckless SSH, test the rules themselves, manage exceptions like privileges, and clean up Config labs.

Next module opens with Amazon CloudWatch Metrics, Logs and Alarms.

Further Reading

• AWS Config Developer Guide
• AWS Organizations SCPs
• CloudFormation Guard
• Open Policy Agent
• Conftest
• Terraform plan JSON
• CDK synth