Secure Defaults And Guardrails

• Create golden templates (IaC, CI/CD) with safe defaults.
• Write policy-as-code to block risky changes before merge/deploy.
• Design an exception process with time-bound approvals and audit.
• Measure coverage and drift to keep guardrails effective.

Objective: ensure any pod is limited, isolated, and non-root by default.

# Namespace template values (Helm) produce:
apiVersion: v1
kind: ResourceQuota
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi
    limits.cpu: "4"
    limits.memory: 8Gi
---
apiVersion: v1
kind: LimitRange
spec:
  limits:
    - type: Container
      default:
        cpu: "500m"
        memory: 512Mi
      defaultRequest:
        cpu: "200m"
        memory: 256Mi
---
# Default deny egress + ingress, teams must explicitly open flows
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector: {}
  policyTypes: ["Ingress","Egress"]
  ingress: []
  egress: []
---
# Pod Security: baseline/restricted
apiVersion: policy
kind: PodSecurity
# or use built-in Pod Security Admission labels at namespace level
metadata:
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

Guardrail: admission policy (OPA/Gatekeeper or Kyverno) that denies pods without runAsNonRoot, readOnlyRootFilesystem, and drops all capabilities except those explicitly allowed.

# Kyverno example policy snippet
apiVersion: kyverno.io/v1
kind: ClusterPolicy
spec:
  rules:
    - name: require-seccontext
      match:
        resources:
          kinds: ["Pod"]
      validate:
        message: "Pods must run as non-root with read-only root FS"
        pattern:
          spec:
            securityContext:
              runAsNonRoot: true
            containers:
            - securityContext:
                readOnlyRootFilesystem: true
                allowPrivilegeEscalation: false

Objective: all buckets encrypted, private, and logged by default.

# Module variables have safe defaults, not booleans left false
data "aws_kms_key" "s3" { key_id = "alias/org-s3" }

resource "aws_s3_bucket" "this" {
  bucket        = var.name
  force_destroy = false
}

resource "aws_s3_bucket_public_access_block" "this" {
  bucket                  = aws_s3_bucket.this.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule { apply_server_side_encryption_by_default { kms_master_key_id = data.aws_kms_key.s3.arn sse_algorithm = "aws:kms" } }
}

# Access logs on by default (module creates a central logging bucket)
# Consumers can override, but not disable without an exception

Guardrail: policy-as-code (e.g., OPA/Conftest) that fails PR if s3 public access or SSE is missing.

# OPA Rego sketch
package terraform.s3

deny[msg] {
  input.resource.type == "aws_s3_bucket_public_access_block"
  not input.resource.values.block_public_acls
  msg := "S3 buckets must block public ACLs"
}

deny[msg] {
  input.resource.type == "aws_s3_bucket_server_side_encryption_configuration"
  not input.resource.values.rule.apply_server_side_encryption_by_default.sse_algorithm
  msg := "SSE-KMS must be enabled"
}

Objective: stop risky artifacts before deployment.

# Pseudocode for a shared pipeline template (e.g., GitHub Actions, GitLab CI)
jobs:
  sast:
    steps:
      - run: code-scan --min-severity=medium --fail-on=found
  deps:
    steps:
      - run: dep-audit --deny="critical|high" --fail-on=found
  image_scan:
    steps:
      - run: trivy image $IMAGE --severity HIGH,CRITICAL --exit-code 1
  sign:
    steps:
      - run: cosign sign $IMAGE
  verify:
    needs: [sign]
    steps:
      - run: cosign verify --key org.pub $IMAGE
  policy_check:
    needs: [verify]
    steps:
      - run: conftest test ./ --policy ./policy
  deploy:
    needs: [policy_check]
    if: ${{ success() }}

Defaults: All projects inherit this pipeline. Teams can add extra checks, but removing steps requires a documented exception.

Default: all workloads go through an egress gateway/proxy; direct internet egress is denied.

Guardrail: network policy and firewall rules enforce proxy usage. Exception: a short-lived allow rule with ticket, owner, scope (FQDNs), and expiry.

• Can a new team deploy without talking to security and still be safe?
• Do your policies fail early with helpful messages?
• Are exceptions time-bound, visible, and auditable?
• Can you show metrics that guardrails are reducing risk and friction?

• Deliverables: repo template with CI checks (SAST, deps, image scan, signature), service manifest with resource limits, liveness/readiness, restricted security context, telemetry pre-wired.
• Acceptance: a new repo from the template deploys cleanly with zero policy violations.

• Deliverables: OPA/Conftest rules for S3/Blob storage enforcing encryption, no public access, access logging, lifecycle policies.
• Acceptance: PR with a non-compliant bucket fails with a clear message and suggested fix.

• Deliverables: default deny egress, allow via proxy; exception CRD/YAML with owner, reason, allowed domains, expiry.
• Acceptance: exception auto-revokes on expiry and is visible in audit logs.

• Platform and DevOps engineers building shared infrastructure.
• Security engineers implementing policy-as-code.
• Developers who own service templates.

• Basic Kubernetes (namespaces, deployments, policies).
• Intro Terraform or other IaC.
• Familiarity with CI/CD concepts.