/policy-as-code-generator

name: policy-as-code-generator
description: Converts natural language compliance requirements into executable policies (OPA Rego, AWS Config Rules, Sentinel, Terraform). Standardizes governance by making it part of the build process.
allowed-tools: Bash, Read, Glob, Write, Edit

Policy-as-Code Generator

Converts natural language compliance requirements into executable policy code. Generates OPA Rego, AWS Config Rules, Sentinel policies, or Terraform modules.

Quick Commands

**Generate OPA Rego policy:**

node plugins/grc-engineer/scripts/generate-policy.js "Ensure no S3 buckets are public and all must have a 'Department' tag" rego

**Generate AWS Config Rule:**

node plugins/grc-engineer/scripts/generate-policy.js "All EC2 instances must have encryption enabled" aws-config

**Generate Sentinel policy:**

node plugins/grc-engineer/scripts/generate-policy.js "Terraform plans must not create resources without required tags" sentinel

Supported Output Formats

• **rego** - Open Policy Agent (OPA) Rego language
• **sentinel** - HashiCorp Sentinel policy language
• **aws-config** - AWS Config Rule (Python/Lambda)
• **terraform** - Terraform policy module
• **checkov** - Checkov YAML policy

Example Inputs

• "Ensure no S3 buckets are public and all must have a 'Department' tag"
• "All EC2 instances must have encryption enabled and be in a VPC"
• "Terraform plans must not create resources without required tags"
• "Kubernetes pods must not run as root user"
• "All databases must have automated backups enabled"

Output Structure

Generated policies include:

• Policy definition with clear logic
• Test cases/examples
• Documentation comments
• Integration instructions for CI/CD

Prerequisites

• Natural language requirement description
• Optional: Output format (defaults to rego)