The "Logic Engine"
Open Policy Agent (OPA) (pronounced "oh-pa") is the industry-standard, open-source engine for general-purpose policy enforcement. Unlike Checkov, which ships with a fixed library of rules, OPA gives you a blank canvas. You write any rule you can express in logic, and OPA enforces it.
OPA is used far beyond Terraform. The same engine enforces admission policies in Kubernetes (via Gatekeeper), authorization rules in APIs, and data access policies in microservices. Learning OPA once gives you a tool that works across your entire stack.
OPA works by separating policy decision-making from policy enforcement:
- Enforcement is your responsibility: your CI pipeline sends OPA a question — "Here is the Terraform plan JSON; is this allowed?"
- Decision-making is OPA's responsibility: it evaluates your rules against the input data and returns a structured answer — "Yes" or "No, and here's why."
This separation is powerful. You can update policies without touching your pipeline code, and you can test policies independently without running real infrastructure.
Rego: The Policy Language
To write rules for OPA, you use a language called Rego (pronounced "ray-go"). Rego is declarative — you don't tell it how to check things step by step. Instead, you describe what a violation looks like, and OPA searches the input data to find anything that matches that description.
This is the same mental model as SQL: you don't write a loop to scan a database table. You write a WHERE clause describing what you want, and the database engine figures out how to find it. Rego works the same way — you describe the shape of a violation, and OPA finds all instances of it.