policy Command

Generates security policies (OPA/Rego, CODEOWNERS) based on your project.

Usage

dso policy [path]

Description

The policy command automatically generates security policies based on your project structure and detected security patterns. It supports:

• OPA/Rego: Policy-as-code for security validation
• CODEOWNERS: GitHub code ownership rules for security reviews

Options

--type, -t

Policy type to generate:

# Generate OPA/Rego policy
dso policy --type opa .

# Generate CODEOWNERS
dso policy --type codeowners .

Default: opa

Supported types:

• opa or rego: Open Policy Agent Rego policy
• codeowners: GitHub CODEOWNERS file

--output, -o

Output file path:

# Custom output location
dso policy --type opa --output policies/security.rego .

# Default locations:
# - OPA: .dso/policy.rego
# - CODEOWNERS: .github/CODEOWNERS

Examples

Generate OPA Policy

dso policy --type opa .

Generates .dso/policy.rego with rules for:

• Secret detection (AWS keys, API tokens, etc.)
• Docker security (non-root users)
• Terraform security (public resources)
• Kubernetes security (secrets in plain text)

Generate CODEOWNERS

dso policy --type codeowners .

Generates .github/CODEOWNERS with ownership rules for:

• Security-sensitive files
• Configuration files
• CI/CD workflows
• Infrastructure code

Custom Output Location

dso policy --type opa --output policies/security.rego .

OPA/Rego Policy

The generated OPA policy includes rules for:

Secret Detection

deny_secrets[msg] {
    file := input.files[_]
    contains(file.content, "AKIA")
    msg := sprintf("AWS secret detected in %v", [file.path])
}

Docker Security

deny_docker_root[msg] {
    file := input.files[_]
    startswith(file.path, "Dockerfile")
    contains(file.content, "USER root")
    msg := sprintf("Dockerfile should use non-root user", [file.path])
}

Terraform Security

deny_public_resources[msg] {
    file := input.files[_]
    endswith(file.path, ".tf")
    contains(file.content, "aws_s3_bucket")
    msg := sprintf("Potentially public S3 bucket", [file.path])
}

CODEOWNERS File

The generated CODEOWNERS file includes:

# Secrets and credentials
**/.env*
**/secrets/**
**/*secret*
**/*password*
**/*token*
**/*key*

# Infrastructure as Code
**/*.tf
**/*.tfvars
**/terraform/**

# Kubernetes
**/k8s/**
**/kubernetes/**

# CI/CD
/.github/workflows/**
/.gitlab-ci.yml

Integration

With OPA

Use the generated policy with OPA:

# Evaluate policy
opa eval --data .dso/policy.rego --input project.json 'data.dso.security.deny'

With GitHub

The CODEOWNERS file automatically works with GitHub:

• Security-sensitive files require review from specified owners
• Pull requests are automatically assigned to code owners

Customization

The generated policies are based on detected patterns in your project. To customize:

1. Generate the policy
2. Edit the generated file
3. Commit to your repository

Note: The policy file includes a comment:

# Security policy generated by DSO
# Do not modify manually - regenerate with: dso policy --type opa

See Also

• audit: Run an audit to identify security patterns
• ci: Generate CI/CD workflows that use policies
• OPA Documentation