IaC Policy Gates

The plan is flattened. Every resource a module declares is expanded into the plan's resource lists under a module-qualified address such as module.network.aws_s3_bucket.flow_logs, so ordinary resource rules fire on module-created resources without knowing modules exist.

A chart's templates are Go template text, not valid YAML, and fields hidden behind conditionals only appear once values are applied. Render the chart first, then evaluate the manifests it produces.

planned_values is the whole post-apply state, every managed resource including untouched ones. resource_changes is the per-resource diff, carrying the action and the before and after values. A rule over planned_values judges the estate; a rule over resource_changes judges this run.

It means the value does not exist yet: the provider or cloud only produces it when the resource is actually created, so the plan holds a placeholder. A policy rule evaluating that attribute has nothing real to test.

tfplan gives the changes this run proposes, tfstate gives the resources the workspace already has, and tfconfig gives the configuration as written. They are three separate documents, so a rule reads whichever one answers its question.

A plan only contains the resources a change touches, so anything nobody is editing never appears in it. Running the same rule over recorded state or a cloud inventory judges every resource that exists, changed or not.

Lowering a backup window on an existing database is planned as an in-place edit, so change.actions is ["update"], not ["create"]. The filter never matched, so the rule never ran. Match when the actions array contains create or update.

A value that does not exist matches nothing. The rule hunts for a forbidden TLS policy, finds no value at all under that attribute, and reports no violation — a pass that looks identical in CI to a genuine one.

Because conftest policies read the parsed document, not the file text, and each parser produces a different shape. A Dockerfile becomes an array of instruction objects, a Kubernetes container env is a list of name/value objects, and a pipeline env is a plain map - three different paths for one logical field.

The two runs evaluated different documents. Compare the rendered output, not the chart: the values files, set flags, release name and subchart versions used by each render decide whether the fields the rule wants exist at all.

Review the skip as the change, not the comment: decide whether the finding is real or a rule bug, insist on the narrowest form, require a reason checkable in the same diff, and remember an annotation has no expiry and no approver.

conftest parses structured configuration - YAML, JSON, HCL, Dockerfiles, TOML, INI and more - into one JSON-like document and evaluates policies against it. Failures print to the console and the process exits non-zero, which is the signal CI acts on.

Checkov custom checks come in two forms: a declarative YAML policy made of attribute or connection conditions, and a Python class implementing a scan method. YAML covers straightforward attribute comparisons; Python is for logic YAML operators cannot express.

A checkov:skip comment suppresses one named check for the single block it sits inside. The form is checkov:skip=CHECK_ID:reason; the reason is free text nothing validates, and the finding is reported as skipped rather than failing the run.

Strip the reference down to its bare resource address, then look that address up among the planned resources. The two sides do not match literally: configuration addresses carry no count or for_each index, and module resources are nested differently in each section.

Read the plan's configuration section rather than its expanded resources: walk each entry under the root module's module_calls, match the source string against an allowlist the platform team owns, and require an exact version rather than a floating range or a mutable reference.

It sees the intrinsic itself, as data: a Ref or Fn::If node, not a resolved value. Nothing resolves parameters or conditions before deployment, so an equality test against a literal never matches.

A resource being destroyed has no after values, and it is absent from the plan's planned end state entirely. Its tags live in the change's before values, taken from prior state — so the rule must read before, not after.

The rule named main decides it: the policy passes only when main evaluates to true. Rules are evaluated lazily, so a rule that main never reaches is never evaluated at all and silently enforces nothing.

Checkov hands scan_resource_conf its own parsed representation of the block, where every attribute value is wrapped in a list. conf["ami"] is ["ami-0aaa1111"], never the bare string, so the comparison is always false and the check fails everything.

It loses the change action, the prior value, the surrounding request context that identified the author, and the implicit scope of only judging touched resources. A state record is attributes with no verb attached.

An inline skip fits one resource that legitimately violates one check: narrow, and visible in the diff. Use skip-check or skip-path only when the rule or path is wrong for the whole scan, since both are invisible at the violating line.

Translate the address back to the top-level module call the developer can actually edit, then fix it where it is fixable: a module input, a newer pinned version, or an upstream change. Attach any exception to the module and version, not to one plan.

Decide per control, not globally: blocking every unknown is safest but taxes teams with failures they cannot act on, deferring the assertion leaves a window where non-compliant infrastructure exists, and constraining the module input removes the unknown wherever you own the code.

A conftest run with nothing to evaluate exits zero. The usual causes are a namespace never selected on the command line, a renamed policy package, a glob that missed the files, or an extension with no parser attached - all of which look identical to a clean pass.

Nothing is deploying, so no gate can refuse it — the finding only starts a human workflow: an expiring exception, an owned ticket with a date, or a fix shipped through code. A clean re-run is the closure.

Keep the blocking rule scoped to changed resources, and add a scheduled evaluation over the full recorded state that reports rather than blocks. Give each finding an owner and a date; widen the blocking rule once the backlog is drained.

Extend the scanner while your rules fit its model and its authors are the people already on the rota: you inherit its parsing, reporting, ids and pipeline placement for free. Adopt a separate engine when rules must span artifacts the scanner cannot parse, or when several gates should share one rule language.

conftest evaluates each YAML document in the stream separately, so a rule can never see a Deployment and a PodDisruptionBudget at the same time. Combine the inputs into one evaluation, or the rule stays permanently undefined.