# Welcome to the Policy as Code Forum! Get started here **URL:** \ **Category:** Project Discussions\ **Tags:** policy-as-code\ **Created:** [May 2, 2024, 2:49pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265 "2024-05-02T14:49:08Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![CindyRuss](https://avatars.discourse-cdn.com/v4/letter/c/4bbf92/32.png) [@CindyRuss](https://forum.ansible.com/u/CindyRuss)\ **Post date:** [May 2, 2024, 2:49pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/1 "2024-05-02T14:49:08Z")
Your Red Hat team is excited to have this new forum to discuss thought leadership and best practices around our vision for automated Policy As Code. We have some ideas and also want to hear from you. What do you use today to manage policies? What are your most important use cases? How can you organize “as code” to help prepare for automating policy enforcement? Let’s get the discussion started! I suggest you start by giving this [blog](https://www.redhat.com/en/blog/look-policy-code-why-now-and-how-can-it-help?channel=/en/blog/channel/management-and-automation) from Richard Henshall a read. Stay tuned for even more news I will share around this area soon. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [May 2, 2024, 3:56pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/2 "2024-05-02T15:56:31Z")
For the most part where I work, we have only setup Policies and a number of Security monitoring/scanning tools to provide _visibility_ on our security posture. We use Satellite, have its inventory registered to Insights, and OpenScap policies setup (on Satellite, not Insights/Compliance) to scan weekly. There’s a handful of things we harden with code via Ansible, either as Satellite Ansible Roles or with post-provisioning playbooks. That being said, we haven’t yet reached a point in our _Infra-as-code_ automation to be comfortable with including _Policy-as-code_. To me, IaC is an important prerequisite to PaC. We haven’t been able to justify the licensing cost of AAP, so we use the upstream AWX, Galaxy-NG, and EDA-Server opensource versions. (AWX is custom built to support OCP, since we _are_ an OpenShift customer) Our deployment of AWX is in its final phase of making its way into production and taking over some of our Ansible-related IaC practices. Once IaC is ready, PaC will be something we’re looking to improve on (and make those OpenScap reports in Satellite happy!). That said, we do _not_ necessarily trust Ansible automation from outside the business, even from RedHat, so we would need to review whatever Ansible resources may come from your team. We already do this for the infra.\* collections from redhat-cop, for e.g., and I’m willing to contribute code to projects upstream if it suits our business needs. On the other hand, I have yet to see an Ansible playbook provided by Insights Recommendations that I liked, but I also haven’t looked recently to see if there’s been any improvements. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [May 2, 2024, 4:09pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/3 "2024-05-02T16:09:41Z")
Also, I think this and your related ISV post would be more appropriate in #Project Discussions than #Get Help ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [May 3, 2024, 9:56am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/4 "2024-05-03T09:56:42Z")
Hi Caleb. Thanks for your comments! I’m the Ansible Product Manager who will be leading the charge on our automated policy-as-code initiative. This will be an AAP platform integrated feature, introducing net new capabilities to be able to enforce policies (aka rules) both before and during automation tasks. You won’t need IaC to use PaC. They are complementary. I see you’re already doing configuration-as-code using our excellent CoP collections. It’s just the same paradigm and approach. PaC is not designed to provide yet another answer to solutions such that OpenSCAP provides, but will compliment them in many ways. It’s designed to be much broader than that and allow you to enforce standards, limits, mandatory requirements (like change request numbers) in and around all your automation. We’ll be covering elements of policy enforcement across the automation supply chain, from when you create automation content through to running it in production. This (with AAP) will provide customers with several enforcement points which they can choose to leverage. I’ve listed some example use cases for various categories to give you a further idea of the type of things you’ll be able to do: **NETWORK** - Any device configuration does not have insecure telnet as a connection protocol open - Cisco devices do not allow for plaintext SSH password authentication **CLOUD** - If the cloud [Azure] region is allowed to be used - If the AWS instance size falls within the acceptable range (cost optimization) **SECURITY** - Deny access to any database containing sensitive data from IP addresses outside the company network **INFRASTRUCTURE** - Ensure all web servers in a production environment have a specific security group (SG) attached - No non-production SSH keys are allowed in production environments - No direct root access allowed to servers This is just some of the possibilities which I hope gives you more of a feel for what this will be able to do for you! Phil. ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [May 8, 2024, 8:19am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/5 "2024-05-08T08:19:06Z")
> [@Denney-tech](#): > > … would be more appropriate in #Project Discussions I agree - I’ve moved them both 🙂 ---
**Author:** ![CindyRuss](https://avatars.discourse-cdn.com/v4/letter/c/4bbf92/32.png) [@CindyRuss](https://forum.ansible.com/u/CindyRuss)\ **Post date:** [May 10, 2024, 3:48pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/6 "2024-05-10T15:48:31Z")
You can read more details on our Policy as Code vision at the link below and stay tuned for even more information to come! [https://www.redhat.com/en/about/press-releases/red-hat-introduces-policy-code-help-address-ai-complexities-scale](https://www.redhat.com/en/about/press-releases/red-hat-introduces-policy-code-help-address-ai-complexities-scale) ---
**Author:** ![CindyRuss](https://avatars.discourse-cdn.com/v4/letter/c/4bbf92/32.png) [@CindyRuss](https://forum.ansible.com/u/CindyRuss)\ **Post date:** [May 13, 2024, 8:04pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/7 "2024-05-13T20:04:56Z")
Red Hat Summit was a great time, in part because of the warm reception we got from customers around Policy as Code. We want to get the conversation going. As you probably know about Red Hat, we like a “start small, think big” approach to new automation areas. So in the Policy as Code space, this may be internal policies you want to enforce – such as the max size or configuration of a cloud instance or settings on your firewall. What do you have in mind for enforcing policies? Would you like to see us working with any key partners? ---
**Author:** ![fale](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fale/32/2181_2.png) [@fale](https://forum.ansible.com/u/fale)\ **Post date:** [May 15, 2024, 10:38am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/8 "2024-05-15T10:38:56Z")
I would like to contribute some ideas of policies I would find useful: - Ensure that a playbook does not dump certain variables - Ensure that a playbook does not touch certain files (ie: /etc/sudoers) - Ensure that a playbook does not open certain firewall ports - Ensure certain task can not save to variables ---
**Author:** ![CindyRuss](https://avatars.discourse-cdn.com/v4/letter/c/4bbf92/32.png) [@CindyRuss](https://forum.ansible.com/u/CindyRuss)\ **Post date:** [May 16, 2024, 1:51pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/9 "2024-05-16T13:51:14Z")
> [@fale](#): > > - Ensure that a playbook does not dump certain variables > - Ensure that a playbook does not touch certain files (ie: /etc/sudoers) > - Ensure that a playbook does not open certain firewall ports > - Ensure certain task can not save to variables Great suggestions! Keep them coming! ---
**Author:** ![ynotbhatc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ynotbhatc/32/3475_2.png) [@ynotbhatc](https://forum.ansible.com/u/ynotbhatc)\ **Post date:** [May 16, 2024, 10:41pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/10 "2024-05-16T22:41:24Z")
Yes: Styra and IBM 😉 ---
**Author:** ![kmf](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kmf/32/490_2.png) [@kmf](https://forum.ansible.com/u/kmf)\ **Post date:** [June 3, 2024, 4:48pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/11 "2024-06-03T16:48:51Z")
We use Chef InSpec and Mondoo Looking forward to this ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 4, 2024, 12:42pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/12 "2024-06-04T12:42:36Z")
Hi Karl! I’d be very interested to hear about your experiences with those products and why the Ansible alternative is of interest to you? ---
**Author:** ![CindyRuss](https://avatars.discourse-cdn.com/v4/letter/c/4bbf92/32.png) [@CindyRuss](https://forum.ansible.com/u/CindyRuss)\ **Post date:** [June 12, 2024, 2:48pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/13 "2024-06-12T14:48:51Z")
Check us out next week (June 18th) on our first Policy as Code webinar. We’ll explain more of our thinking and build on what we said at Red Hat Summit. Phil Griffiths and our tech marketing manager Roger Lopez are both presenting. You can register here: [Automating Policy as Code for consistency and compliance](https://www.redhat.com/en/events/webinar/automating-policy-as-code-for-consistency-and-compliance) ---
**Author:** ![ynotbhatc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ynotbhatc/32/3475_2.png) [@ynotbhatc](https://forum.ansible.com/u/ynotbhatc)\ **Post date:** [June 12, 2024, 4:14pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/14 "2024-06-12T16:14:34Z")
I am so excited about seeing this Cindy. Tim ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 13, 2024, 4:49pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/15 "2024-06-13T16:49:34Z")
Hi Fabio. I might have something for you next week. Watch this space! ---
**Author:** ![kmf](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kmf/32/490_2.png) [@kmf](https://forum.ansible.com/u/kmf)\ **Post date:** [June 14, 2024, 4:35am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/16 "2024-06-14T04:35:45Z")
DM me and we can talk ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 14, 2024, 3:07pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/17 "2024-06-14T15:07:27Z")
I want to be excited by the whole PaC (Policy as Code) idea. But, I’m going to be “that guy” for a minute: - I haven’t seen a rigorous definition of “policy”. It seems to me like it’s more of a mindset that’s somehow supposed to separate the actual “things we do” from the more lofty ideal of “the way we do things”. Somehow that doesn’t inform my fingers when I open my _Editor of Choice_ and start to type. - Maybe I’ve hit my own personal ceiling on levels of abstraction, but I don’t see how – in actual practice – PaC differs from the same ol’ Ansible tasks we’ve been hacking on these last few years. If I really stretch credulity, I might comfortably claim that a set of tasks that truly is idempotent as a unit constitutes a chunk of PaC. But, honestly, I’d be more comfortable just claiming it’s a good set of tasks. Truly I hope there’s more to it beyond aspirational hand waving. When I open a text file, what can I look for that clearly indicates it’s Policy as Code vs. mere code? ---
**Author:** ![ynotbhatc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ynotbhatc/32/3475_2.png) [@ynotbhatc](https://forum.ansible.com/u/ynotbhatc)\ **Post date:** [June 14, 2024, 4:40pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/18 "2024-06-14T16:40:02Z")
Todd, Very good questions and notes, and probably a good starting point for many of those that have been using Ansible for a bit. And I don’t have a lot of information about the current BU thinking. That being said this is a little description of some of the pre-work. When we first rolled this out for Large Beverage Company a couple of years ago, John Martin integrated a policy engine with AAP - “OPA”. What this provided over just doing things inside of playbooks is the ability to build standard libraries for policies. Some of the existing libraries include CIS benchmarks, PCI compliance policies etc. The initial work was providing the ability to build out policies that could be applied to all playbooks to ensure that things like tagging and basic naming conventions were followed consistently. Frankly, Policy as Code isn’t a new concept, we were going against HashiCorp Sentinel in that first account, and there are other products out there that are focused on this space But having the ability to build libraries that can be re-used for evaluating and aligning playbooks and for evaluation of the results from gather\_facts etc, is what I am hoping for from the BU’s efforts. My hope is that we end up with a functional product that allows for automating compliance efforts. Automating compliance efforts would give us the ability to take a large part of the $25B compliance market, and ensure that AAP would cover 100% of our customers environments. ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 14, 2024, 5:48pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/19 "2024-06-14T17:48:54Z")
Hi Todd. This is fair enough as we haven’t shown you any technical detail yet. Not sure if you’ve signed up for the webinar next week ([Automated Policy as Code with Red Hat Ansible Automation Platform](http://redhat.com/pac)) but you’ll want to 🙂 ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [June 17, 2024, 12:14pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/20 "2024-06-17T12:14:36Z")
I hope someone will be writing a summary of that webinar too. Wouldn’t do to leave out people who can’t make it (due to timezone, work commitments, family, etc). Global communities are the best 😉 [Next page](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265.md?page=2)