Using the OPA plugin

Enforce policies in env zero deployments using the OPA plugin, which installs the opa binary and runs opa eval against a bundle path with a specified query.

Overview

This plugin executes the Open Policy Agent engine (aka the opa CLI) and integrates policy enforcement within your env zero deployments.

The plugin will install the opa binary and execute its opa eval command

For more information, check out the OPA Plugin git repository.

Inputs

To use the OPA plugin, reference it in your custom flow and pass the following inputs:

1. path (Required) - the path to your bundle directory (the root folder is your project’s root folder)
2. query (Required) - a query to eval with opa eval
3. flags - a string containing additional flags as one string

Further reading

• Using Open Policy Agent (OPA) with Terraform: tutorial and examples
• How policy-as-code enhances infrastructure governance with OPA

Next steps

To start from prewritten guardrails instead of your own policy code, browse the ready-to-use policies.