Custom Policies

Your Rules, Enforced Automatically

Custom Policies let you define organization-specific rules for your IaC. Naming conventions, required tags, encryption requirements, forbidden configurations—if you can describe it, you can enforce it.

Your Rules

Define exactly what compliant infrastructure looks like

Auto-Enforced

Checked on every PR and agent session

Version Controlled

Track changes, rollback if needed

Test First

Preview mode before enforcement

Custom Policies is a Feature Preview. Enable it in Settings → Features.

Quick Example

Here’s a policy requiring encryption on all S3 buckets:

Name: S3 Encryption Required
Description: All S3 buckets must have server-side encryption
Severity: High
Scope: All (PR Reviews + AI Agents)

Rules:
  Resource: aws_s3_bucket
  Condition: server_side_encryption_configuration must exist

When violated, it shows up in PRs:

🔴 High: S3 Encryption Required

File: modules/storage/main.tf (line 15)
Resource "aws_s3_bucket.logs" missing encryption configuration.

Fix: Add server_side_encryption_configuration block.

Creating a Policy

Open Policy Editor

Settings → Policies → Create Policy

Name & Describe

Clear name + why this matters

Set Severity

Critical, High, Medium, or Low

Define Rules

Resource types + conditions

Choose Scope

Where to enforce: PRs, agents, or both

Severity Levels

Level	When to Use	Blocks Merge?
🔴 Critical	Public exposure, data leak risk	Yes (if configured)
🟠 High	Missing encryption, weak IAM	Recommended
🟡 Medium	Missing logging, no tags	Optional
🔵 Low	Naming conventions	No

Common Policies

Security
Tagging
Naming
Config

# No public S3 buckets
Name: Block Public S3
Severity: Critical
Condition: acl != "public-read" AND acl != "public-read-write"

# Require encryption at rest
Name: RDS Encryption Required
Severity: High
Condition: storage_encrypted == true

# TLS 1.2 minimum
Name: Enforce TLS 1.2
Severity: High
Condition: min_tls_version IN ["TLS1_2", "TLS1_3"]

# Required tags
Name: Mandatory Tags
Severity: Medium
Conditions:
  - tags.Environment must exist
  - tags.Owner must exist
  - tags.CostCenter must exist

# Environment values
Name: Valid Environment Tag
Severity: Low
Condition: tags.Environment IN ["dev", "staging", "prod"]

# Resource naming convention
Name: Standard Naming
Severity: Low
Condition: name MATCHES "^(dev|stg|prod)-[a-z]+-[a-z0-9]+$"

# Bucket naming
Name: S3 Naming Convention
Severity: Low
Condition: bucket MATCHES "^myorg-[a-z]+-[a-z0-9]+$"

# Require versioning
Name: S3 Versioning Required
Severity: Medium
Condition: versioning.enabled == true

# Multi-AZ for production
Name: Prod RDS Multi-AZ
Severity: High
Condition: multi_az == true WHEN tags.Environment == "prod"

Where Policies Apply

PR Reviews

Violations appear as review comments. Can block merge on Critical.

AI Agents

Agent follows policies when generating code. Violations flagged before PR.

Per-Repository Overrides

Exclude specific repos from policies
Apply stricter rules to production repos
Different policies for different teams

Testing Before Enforcing

Always test new policies before turning them on!

Preview Mode

Create policy with scope: Disabled
Run manual scan on a repo
See what would be flagged
Adjust rules
Enable when ready

Dry Run

See affected resources across all repos
Estimate violation count
Identify false positives
Refine before enforcement

Version Control

Every policy change is tracked:

Feature	What It Does
History	See all versions, who changed what
Compare	Diff between versions
Rollback	Revert to any previous version
Audit	Full change log for compliance

Handling Violations

When a policy is violated, you can:

Action	When to Use
Fix it	Update the resource to comply
Accept risk	Document why it’s ok (with justification)
Update policy	Add exception for this case
Suppress	Ignore for specific resources

Best Practices

Start with Templates

Use built-in templates as starting points

Test First

Preview mode before enforcement

Document Why

Clear descriptions help future you

Review Quarterly

Keep policies current

Severity matters: Critical should mean “stop everything.” Don’t overuse it or people ignore it.

Troubleshooting

Problem	Fix
Policy not evaluating	Check scope isn’t “Disabled”, repo isn’t excluded
Too many false positives	Add exceptions, narrow conditions
Changes not taking effect	Make sure you saved, check for rollbacks

Next Steps

PR Reviews

See policies in action on PRs

AI DevOps

Policy-aware code generation

Compliance Frameworks

Industry-standard checks

Static Analysis

Built-in security scanning

Getting Started

Features

Integrations

CLI

Scanning & Findings

Remediation

Compliance

Examples

Troubleshooting

Support

Your Rules, Enforced Automatically

Your Rules

Auto-Enforced

Version Controlled

Test First

Quick Example

Creating a Policy

Severity Levels

Common Policies

Where Policies Apply

PR Reviews

AI Agents

Per-Repository Overrides

Testing Before Enforcing

Preview Mode

Dry Run

Version Control

Handling Violations

Best Practices

Start with Templates

Test First

Document Why

Review Quarterly

Troubleshooting

Next Steps

PR Reviews

AI DevOps

Compliance Frameworks

Static Analysis

Getting Started

Features

Integrations

CLI

Scanning & Findings

Remediation

Compliance

Examples

Troubleshooting

Support

​Your Rules, Enforced Automatically

Your Rules

Auto-Enforced

Version Controlled

Test First

​Quick Example

​Creating a Policy

​Severity Levels

​Common Policies

​Where Policies Apply

PR Reviews

AI Agents

​Per-Repository Overrides

​Testing Before Enforcing

​Preview Mode

​Dry Run

​Version Control

​Handling Violations

​Best Practices

Start with Templates

Test First

Document Why

Review Quarterly

​Troubleshooting

​Next Steps

PR Reviews

AI DevOps

Compliance Frameworks

Static Analysis

Your Rules, Enforced Automatically

Quick Example

Creating a Policy

Severity Levels

Common Policies

Where Policies Apply

Per-Repository Overrides

Testing Before Enforcing

Preview Mode

Dry Run

Version Control

Handling Violations

Best Practices

Troubleshooting

Next Steps