PolicyForge: Policy-as-Code Scanner

Overview

PolicyForge is a Go CLI that scans Terraform, Bicep, Kubernetes, and Helm manifests against the same OPA/Rego rule packs through a shared canonical resource model: a rule written once evaluates Terraform and Bicep identically. Azure is treated as a first-class target, with Bicep and Azure Policy alignment fully supported rather than bolted on, and every scan generates an SBOM. Currently at v0.1, with the CLI running end-to-end against real IaC and rule packs embedded at build time.

Key Features

• scan command with table, SARIF, and JSON output for Terraform, Bicep, Kubernetes, and Helm
• Custom policy authoring via --policy-dir: drop in .rego files with no fork required
• Supply-chain signing and attestation via cosign, SLSA provenance predicates, and the Rekor transparency log
• drift command comparing declared IaC against live Azure state via Azure Resource Graph
• 13 built-in rules spanning CIS Azure Foundations, AWS S3/security-group checks, and Kubernetes Pod Security Standards
• GitHub Actions and Azure DevOps integrations, surfacing SARIF results as native code-scanning findings
• Self-hosted enterprise portal (Go API, SQLite, HTTP Basic Auth / OIDC-Entra SSO, Next.js dashboard) that ingests scan results via --upload

Challenges

• Designing one canonical resource model expressive enough for a single Rego rule pack to evaluate Terraform and Bicep identically
• Keeping Azure a first-class target rather than an AWS-first tool with Azure support bolted on
• Scoping a v0.1 core (CLI, rule packs, SBOM) that's useful standalone, with signing, drift detection, and the enterprise portal layered on without bloating it

Tech Stack

Source

System Architecture