Policy as Code, Cost Checks, and Supply-Chain Security

Policy as Code, Cost Checks, and Supply-Chain Security is taught here as an engineering decision, not a command to memorize. Treat infrastructure changes as reviewed software releases with isolated tests and controlled credentials.

This is lesson 24 of the Terraform and Infrastructure as Code curriculum. By the end, you should be able to explain the mechanism, implement a small example, identify unsafe assumptions, and define evidence that would justify using the technique in production.

Why Policy as Code, Cost Checks, and Supply-Chain Security Matters

Terraform constructs a dependency graph from configuration, provider schemas, current state, and refreshed remote objects, then proposes a plan to reconcile infrastructure. Safety depends on reviewed plans, protected and locked remote state, constrained modules, short-lived credentials, deterministic automation, and explicit handling of imports, replacements, drift, and destruction.

Policy as Code, Cost Checks, and Supply-Chain Security belongs in that model because it changes how the system represents state, enforces a boundary, or behaves when work and failures overlap. Treat the feature as part of a wider contract: name its owner, inputs, outputs, persistent effects, limits, and recovery behavior before choosing syntax or tooling.

Core Vocabulary

Term	Practical meaning
`resource address`	the stable configuration identity used to bind an object to state
`provider`	a versioned plugin translating Terraform operations into remote API calls
`state`	the sensitive mapping between resource addresses and real remote objects
`plan`	a proposed action graph derived from configuration, state, and refreshed infrastructure

Mental Model for Policy as Code, Cost Checks, and Supply-Chain Security

Format and validate configuration, initialize pinned providers, run static and policy checks, create a saved plan against protected remote state, review every change and replacement, apply that exact plan through automation, verify outputs and health, and retain state recovery and rollback procedures.

Work through the flow from left to right. At every transition, ask what is trusted, what can be retried, what can be observed, and what must remain atomic. If two operators or requests perform the operation at the same time, the result should still satisfy the documented invariant. If a dependency stops halfway through, the recovery route should be deliberate rather than accidental.

Decision sequence

Write a concrete user or operator outcome and one measurable acceptance condition.
Inventory current state, identities, dependencies, resource limits, and irreversible effects.
Choose the smallest mechanism that preserves the required invariant under concurrency.
Validate configuration and inputs before changing persistent or externally visible state.
Exercise the success path, one malformed-input path, one permission failure, and one dependency failure.
Record the version and telemetry needed to compare the result with the acceptance condition.

Implementation Example

The following example isolates a useful part of Policy as Code, Cost Checks, and Supply-Chain Security. Read names, types, selectors, constraints, and limits as elements of the public contract. Replace demonstration values with reviewed environment-specific configuration before deployment.

terraform {
  required_version = ">= 1.8.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

variable "environment" {
  type        = string
  description = "Deployment environment for policy-as-code-cost-checks-and-supp."
  validation {
    condition     = contains(["dev", "stage", "prod"], var.environment)
    error_message = "environment must be dev, stage, or prod"
  }
}

resource "aws_s3_bucket" "evidence_24" {
  bucket_prefix = "pl-${var.environment}-evidence-"
  tags = {
    Environment = var.environment
    ManagedBy   = "Terraform"
  }

  lifecycle {
    prevent_destroy = true
  }
}

run "valid_environment_24" {
  command = plan

  variables {
    environment = "stage"
  }

  assert {
    condition     = aws_s3_bucket.evidence_24.tags["ManagedBy"] == "Terraform"
    error_message = "required ownership tag is absent"
  }
}

First validate the example locally with the native parser, compiler, renderer, or test framework. Then inspect the produced object or query rather than trusting a successful command. A valid document can still select the wrong workload, scan an entire table, authorize too much, leak a field, train on contaminated data, or make recovery impossible.

Verification Strategy

Verification for Policy as Code, Cost Checks, and Supply-Chain Security needs more than syntax. Add a focused contract test for the intended behavior, an integration test at the nearest real boundary, and an operational check that can run after deployment. Capture both positive evidence and the expected refusal or failure behavior.

Correctness: assert the invariant and exact externally visible result.
Isolation: prove that unrelated identities, tenants, workloads, or datasets are unaffected.
Failure: inject a timeout, invalid value, unavailable dependency, or competing update.
Performance: measure representative volume and concurrency rather than an empty example.
Recovery: execute rollback or restore and confirm that clients return to a valid state.

Common Failure Modes

Copying a quick-start configuration whose defaults do not match the production threat model or workload.
Encoding the happy path while leaving ownership, concurrency, idempotency, and partial failure undefined.
Granting broad permissions because the exact runtime operations were never inventoried.
Optimizing from intuition without a baseline, representative data, or a way to detect regression.
Changing several layers in one release, which makes diagnosis and rollback unnecessarily ambiguous.
Logging secrets or sensitive payloads instead of bounded identifiers and structured failure categories.

Production Design for Policy as Code, Cost Checks, and Supply-Chain Security

Production readiness means the behavior is bounded and owned. Set explicit time, memory, connection, retry, and output budgets. Keep credentials outside source control, scope them to the minimum capability, and rotate them without rebuilding the application. Version the code, configuration, schema or model artifact, and the procedure used to release them.

Prefer incremental rollout when the platform permits it. Compare error rate, latency, saturation, correctness, and cost with the previous version. A dashboard without an owner and response action is only a visualization; pair every actionable alert with a runbook and a tested safe-disable or rollback mechanism.

Hands-On Exercises

Recreate the Policy as Code, Cost Checks, and Supply-Chain Security example in an isolated environment and annotate every line that establishes a boundary.
Introduce one realistic invalid value and confirm that it is rejected before persistent state changes.
Run two competing operations and document whether the invariant survives their interleaving.
Add least-privilege credentials and prove that an unrelated read or write is denied.
Define a service-level signal, an alert threshold, and the exact rollback or remediation command.

Review Checklist

The intended outcome and non-goals are written in testable language.
Input validation, identity, authorization, concurrency, and resource limits are explicit.
Tests cover normal, adversarial, degraded, and recovery behavior.
Telemetry avoids secrets while identifying version, latency, outcome, and failure category.
The release is reversible and responsibility for monitoring it is assigned.

Summary

Policy as Code, Cost Checks, and Supply-Chain Security becomes dependable when its role in the wider system is explicit. Start with the invariant, choose the narrowest mechanism, validate at boundaries, test concurrency and failure, measure representative behavior, and rehearse recovery. Use the exercises to turn the example into evidence you could defend during a production review.