Policy as Code — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— Policy as Code
✍️Write Policy
🧪Test
🔍Evaluate
🛡️Enforce
📊Audit
🎯 Next: Test →
Step 1 / 5
Speed
Policy Authoring
Define required tags and the deny rule💡 Analogy
Rego policies are like checklist rules — define what must be present, and the policy engine flags anything missing from the checklist.
OPA Rego policies are declarative. required_tags defines what must exist. deny[msg] defines what violates policy. If any deny rule matches, the resource fails the check.
Console Output
# Editing policy/require_tags.rego in VS Code with OPA extension
●policy/require_tags.rego
Policy AuthoringL1–10
1# OPA Rego policy: require mandatory tags on all Azure resources
2package azure.tags
3 
4import future.keywords.in
5 
6# Required tags for all Azure resources
7required_tags := {"environment", "owner", "cost-center", "managed-by"}
8 
9# Deny resources missing required tags
10deny[msg] {
11  resource := input.resource_changes[_]
12  resource.change.actions[_] in {"create", "update"}
13 
14  # Get the tags attribute
15  tags := object.get(resource.change.after, "tags", {})
16 
17  # Find missing required tags
18  missing := required_tags - {tag | tags[tag]}
19  count(missing) > 0
20 
21  msg := sprintf(
22    "Resource '%s' (%s) is missing required tags: %v",
23    [resource.address, resource.type, missing]
24  )
25}
26 
27# Deny resources without proper owner tag format (email)
28deny[msg] {
29  resource := input.resource_changes[_]
30  resource.change.actions[_] in {"create", "update"}
31  tags := object.get(resource.change.after, "tags", {})
32  owner := tags.owner
33  not regex.match("^[a-z]+@company\.com$", owner)
34 
35  msg := sprintf(
36    "Resource '%s' has invalid owner tag '%s'. Must be a @company.com email.",
37    [resource.address, owner]
38  )
39}
39 lines
Timeline — 5 Steps
Policy Authoring
Define required tags and the deny rule💡 Analogy
Rego policies are like checklist rules — define what must be present, and the policy engine flags anything missing from the checklist.
OPA Rego policies are declarative. required_tags defines what must exist. deny[msg] defines what violates policy. If any deny rule matches, the resource fails the check.
Console Output
# Editing policy/require_tags.rego in VS Code with OPA extension

Was this page helpful?

Discussion

Define required tags and the deny rule

💡 Analogy

Rego policies are like checklist rules — define what must be present, and the policy engine flags anything missing from the checklist.

OPA Rego policies are declarative. required_tags defines what must exist. deny[msg] defines what violates policy. If any deny rule matches, the resource fails the check.

Console Output

# Editing policy/require_tags.rego in VS Code with OPA extension

Define required tags and the deny rule

💡 Analogy

Rego policies are like checklist rules — define what must be present, and the policy engine flags anything missing from the checklist.

OPA Rego policies are declarative. required_tags defines what must exist. deny[msg] defines what violates policy. If any deny rule matches, the resource fails the check.

Console Output

# Editing policy/require_tags.rego in VS Code with OPA extension