# What Is Policy as Code? — Checkov, OPA, Sentinel and IaC Scanning Explained

Canonical: https://commareports.com/glossary/policy-as-code
Published: 2026-11-01

> Policy as code means writing infrastructure and security rules as versioned, testable code that runs in CI. How it works, Checkov vs OPA vs Sentinel vs Trivy, where it runs, and how to read the results.

# Policy as code

**Policy as code is writing the rules your infrastructure must follow as code
that a tool checks automatically.** "No public S3 buckets." "Every database
encrypted at rest." "No security group open to 0.0.0.0/0 on port 22." Instead
of a checklist a reviewer is meant to remember, each rule is a policy file in
version control. It runs in CI against every change, and a violation fails
the build or opens a finding.

## Two kinds of tool

| Kind                | Examples                                | You write                      | Good for                                 |
| ------------------- | --------------------------------------- | ------------------------------ | ---------------------------------------- |
| Scanner with checks | Checkov, Trivy (`config`), KICS, tfsec  | Nothing to start; suppressions | Broad baseline across clouds and formats |
| Policy engine       | OPA / Rego, Sentinel, Kyverno, Conftest | Every rule                     | Your org's own rules, admission control  |

Checkov ships over a thousand checks for Terraform, CloudFormation, Kubernetes
manifests, Helm, Dockerfiles and GitHub Actions. tfsec's checks now live in
Trivy, which scans the same files with `trivy config`. OPA evaluates Rego
rules against any JSON. Point it at `terraform show -json` output or a
Kubernetes admission request. Sentinel is HashiCorp's engine, built into
Terraform Cloud and Enterprise between plan and apply.

## Where it runs

1. **Pull request.** Scan the changed Terraform or manifests so the author
   sees the failure before merge.
2. **Against the plan.** `checkov -f plan.json --framework terraform_plan` or
   a Rego rule over the [plan JSON](/glossary/terraform-plan). This catches
   values that only exist once variables and modules resolve, which a source
   scan misses.
3. **At the gate.** Sentinel in Terraform Cloud, OPA Gatekeeper or Kyverno as
   a Kubernetes admission controller. The change is refused, not just
   reported.

## Reading the results

Every scanner reports the same shape. A policy id (`CKV_AWS_20`,
`AVD-AWS-0086`), the resource that failed (`aws_s3_bucket.exports`), the file
and line, and a link to the rule's guideline. Severity varies. Trivy and
KICS always set one. Open-source Checkov leaves it null unless you connect
Prisma Cloud.

Suppressions are part of the result. A finding skipped with a reason
(`#checkov:skip=CKV_AWS_18:public assets bucket`) is a decision someone made.
A good report counts skipped checks next to failed and passed ones, so a
reviewer can see what was waived, not just what's left.

The raw output is the problem. Checkov's CLI prints a block per check into a
CI log, and its JSON is meant for machines. The people who accept the risk —
platform leads, auditors gathering SOC 2 evidence, the client who asked for
an infrastructure review — need the failures grouped by policy with the code
in view, in a document they can comment on.

## Try it

Comma is free: unlimited reports, unlimited commenters, unlimited revision
history.

**[Open the Checkov report viewer →](/tools/checkov-viewer)**

### Related

- [Checkov report viewer](/tools/checkov-viewer) · [Terraform plan viewer](/tools/terraform-plan-viewer) · [SARIF viewer](/tools/sarif-viewer)
- [Share a Checkov report](/share-checkov-report) · [Share a tfsec report](/share-tfsec-report) · [Share a KICS report](/share-kics-report)
- [Terraform plan](/glossary/terraform-plan) · [SARIF](/glossary/sarif) · [Glossary](/glossary)