Governing infrastructure as code using pattern-based policy as code

This post explains how to implement policy-as-code using Open Policy Agent (OPA) in CI/CD pipelines to validate AWS infrastructure changes pre-deployment. It recommends organizing policies around recurring control patterns (required metadata, allowed configuration, exposure restriction, protection enforcement, privilege constraint), provides example checks for S3, security groups, and IAM, and covers pipeline integration, validation artifact retention, testing practices, and a phased rollout from advisory to enforcement.