Skip to content
StackShip

Policy as code

Terraform policy as code with OPA and Rego.

StackShip is an OpenTofu platform with policy as code built in. Versioned Open Policy Agent policies check every plan before anyone can approve the apply.

Start freeRead the policy docs

OPA policy

Policy checks that block risky changes.

  1. 01

    Versioned policies

    opa test runs on publish. Published versions never change.

  2. 02

    Attach at any scope

    Attach to an organization, a project, or one workspace.

  3. 03

    Results on the run

    Every result is stored with the run that produced it.

  4. 04

    Audited overrides

    Soft-mandatory overrides need a reason and are audited.

Enforcement

Three enforcement modes.

Choose a mode for each policy attachment. A policy error always blocks.

  • advisory

    Advisory

    Findings show on the run. The run continues.

  • soft_mandatory

    Soft mandatory

    Approval is blocked until an admin records a justified override.

  • hard_mandatory

    Hard mandatory

    The run fails. No override exists.

Rego

Write OPA policies against the plan.

Policies read the plan's resource changes and return findings. No findings means the plan passes.

policy.rego
package stackship.v1 import rego.v1 decision := {"findings": findings} findings contains finding if {  some change in input.resource_changes  change.change.after.acl == "public-read"  finding := {    "id": "no-public-buckets",    "title": "Public bucket",    "message": "Buckets must not be public.",    "resource_address": change.address,  }}

FAQ

Policy as code questions

Does StackShip support Sentinel policies?

No. StackShip uses Open Policy Agent with Rego v1. Rewrite Sentinel policies in Rego before you attach them.

What input does a policy receive?

A JSON document with the planned resource changes in the shape of tofu show -json, plus run, source, and workspace metadata. Sensitive values are redacted, and policies never see state, variables, or credentials.

Can a failed policy be overridden?

Only soft-mandatory findings. An owner or admin records a justification, the override expires, and it is written to the audit log. Hard-mandatory findings and policy errors always block.

Can I test policies before they enforce?

Yes. Add *_test.rego files next to your policies. StackShip runs opa check --strict and opa test on publish, and a failing version never publishes. The same plan always gets the same result.

Keep reading

In the documentation

Get started

Run your first plan today.

Free for every organization. Sign up with email or Google.

Start freeRead the policy docs