🚀 Terraform Day 21: Policy & Governance Automation on AWS

🎯 What Day 21 Is About

Day 21 demonstrates how to:
Enforce preventive controls using IAM policies
Enable detective controls using AWS Config
Store audit logs securely in S3
Detect non-compliant resources automatically
Troubleshoot real-world permission behavior

This is not theory — it’s hands-on governance automation.

🧠 Policy vs Governance (Core Concept)

Understanding this distinction is mandatory in real projects:

🔐 Policy (Preventive Control)
Implemented using IAM policies
Blocks actions before they happen

Example:
Deny delete without MFA
Deny uploads without encryption
Deny resource creation without required tags

📊 Governance (Detective Control)
Implemented using AWS Config
Detects violations after resources exist

Example:
Unencrypted buckets
Public access enabled
Missing mandatory tags

👉 Policy stops mistakes. Governance reports mistakes.
Both are required.

🗂️ Secure Audit Bucket with Terraform

A dedicated S3 bucket is created for governance logs.
Configured with:
✅ Server-side encryption
✅ Versioning enabled
✅ Public access fully blocked
✅ Bucket policy allowing AWS Config access
This bucket becomes the single source of truth for audit data.

Audit logs must be immutable, private, and durable — Terraform enforces this by design.

🔒 IAM Policies for Enforcement
Multiple custom IAM policies are created using Terraform.
Examples covered:
MFA enforcement for destructive actions
Encryption-in-transit enforcement for S3 uploads
Mandatory EC2 tagging to enforce cost and ownership standards

These policies are:
Written as JSON
Managed via Terraform
Attached to users and roles programmatically

This ensures rules are consistent, repeatable, and reviewable.

📈 AWS Config for Continuous Compliance

AWS Config is enabled end-to-end using Terraform:

Components created:
Config Recorder
Delivery Channel pointing to the audit bucket
Managed compliance rules

Rules demonstrated:
S3 public access prohibited
Encryption enabled on buckets and EBS volumes
Required resource tags
Root account MFA enabled

AWS Config continuously evaluates infrastructure and reports compliance status automatically

✅ Key Takeaways

✔ Policy = prevention
✔ Governance = detection
✔ Terraform can automate both
✔ Secure audit logging is non-negotiable
✔ AWS Config complements IAM — it does not replace it
✔ Testing policies is as important as writing them

This is how production AWS accounts are protected.