Digger supports granular policy-as-code governance via Open Policy Agent (OPA). You can specify policies at project as well as organisation level.
There are 2 types of policies in Digger:
- Plan policies
- Access policies
With plan policies you can check
terraform plan output for compliance with your internal guidelines, for example limiting the kinds of resources that can be provisioned in a particular environment or team. Plan policy is checked after every plan, and before every apply.
With access policies you can control which Digger operations are allowed at any given time based on various inputs. Access policy is checked before every plan and apply and is passed the following data:
- user id (from github)
- plan policy violations, if any
- list of users who approved the PR
This way you can implement custom logic, for example allowing to apply a PR that has policy violations in case certain users approved it.