Agent WranglersPolicy as code
Scan infrastructure code on every change, test your own rules against the plan, block dangerous actions at the organization level, and let exceptions expire.
- Required 2
- Recommended 3
Policy as code turns infrastructure rules into checks that pass or fail. Some checks run on the code before anything changes. Others sit in the cloud and refuse a call even from an admin. Together they catch the mistakes a review misses. They follow the rules as code idea from the engineering playbook.
Required
Scan infrastructure code on every change
RequiredRun an infrastructure scanner on every pull request, and fail the build on any finding rated high or critical.
Block dangerous actions for the whole organization
RequiredSet organization-wide policies that refuse the most dangerous actions in every account, even for admins.
Recommended
Test your own rules against the plan
RecommendedWrite the house rules that no scanner knows as policies, and run them against the plan in CI. Examples are the allowed regions, the required tags and the largest server size.
Let every exception expire
RecommendedGive every skipped check a reason, an owner and an end date in the code. Fail the build once the date has passed.
Test infrastructure modules
RecommendedGive every shared module tests that check its plan, and run them in CI on every change to the module.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/policy-as-code.