IaC governance
Gate your own Terraform and OpenTofu changes against a policy engine that decides but never enforces, including priced cost guardrails in the pull request.
4 lessons. 1 quiz.
Read in order, or jump to what you need.
Decision, not enforcement
By the end of this lesson, you will be able to explain the Policy Decision Point model, describe what ZopNight reads and what it never runs, and place enforcement where it belongs.
Builtin rules and custom Rego
By the end of this lesson, you will be able to navigate the builtin rule set and its compliance-framework tagging, decide when custom Rego is warranted, and explain the native-first loading model.
Cost guardrails in the pull request
By the end of this lesson, you will be able to configure the three priced-plan guardrails, read the dollar figure they surface in a pull request, and choose thresholds that hold.
CI wiring, scans and overrides
By the end of this lesson, you will be able to wire the CI check via the onboarding flow, read an inventory scan's managed-versus-orphan split, and use a governed override without losing the audit trail.
Module quiz.
Take it once the lessons are done.