| name | policy-as-code-generator |
| description | Converts natural language compliance requirements into executable policies (OPA Rego, AWS Config Rules, Sentinel, Terraform). Standardizes governance by making it part of the build process. |
| allowed-tools | Bash, Read, Glob, Write, Edit |
Policy-as-Code Generator
Converts natural language compliance requirements into executable policy code. Generates OPA Rego, AWS Config Rules, Sentinel policies, or Terraform modules.
Quick Commands
Generate OPA Rego policy:
node plugins/grc-engineer/scripts/generate-policy.js "Ensure no S3 buckets are public and all must have a 'Department' tag" rego
Generate AWS Config Rule:
node plugins/grc-engineer/scripts/generate-policy.js "All EC2 instances must have encryption enabled" aws-config
Generate Sentinel policy:
node plugins/grc-engineer/scripts/generate-policy.js "Terraform plans must not create resources without required tags" sentinel
Supported Output Formats
- rego - Open Policy Agent (OPA) Rego language
- sentinel - HashiCorp Sentinel policy language
- aws-config - AWS Config Rule (Python/Lambda)
- terraform - Terraform policy module
- checkov - Checkov YAML policy
Example Inputs
- "Ensure no S3 buckets are public and all must have a 'Department' tag"
- "All EC2 instances must have encryption enabled and be in a VPC"
- "Terraform plans must not create resources without required tags"
- "Kubernetes pods must not run as root user"
- "All databases must have automated backups enabled"
Output Structure
Generated policies include:
- Policy definition with clear logic
- Test cases/examples
- Documentation comments
- Integration instructions for CI/CD
Prerequisites
- Natural language requirement description
- Optional: Output format (defaults to rego)
