- Home
- Infrastructure Policy as Code Tools
- PolicyForge
On the recordRead 9 Oct 202614 facts
PolicyForge
Plans and prices
Open source
Free
Core scanner, rule packs, and CI/CD integrations are open source under Apache 2.0
Read 9 Oct 2026 · github.com
On the record
- Built-in policies
- The project lists 11 built-in rules covering Azure CIS Foundations, AWS, and Kubernetes Pod Security.github.com · read 9 Oct 2026
- CI/CD integrations
- The repository describes a GitHub Action that uploads SARIF to GitHub code scanning and an Azure DevOps task that publishes SARIF as a build artifact.github.com · read 9 Oct 2026
- Custom rules
- Users can add `.rego` rules at scan time with `--policy-dir` without forking or rebuilding.github.com · read 9 Oct 2026
- Drift detection
- It compares declared infrastructure code with live Azure state through Resource Graph, limited to resource types and attributes its rules understand.github.com · read 9 Oct 2026
- Enterprise portal
- An optional self-hosted portal provides a dashboard, audit trail, org-wide policy management, and SOC2/PCI compliance rollups.github.com · read 9 Oct 2026
- Intended users
- The project is aimed at teams scanning infrastructure-as-code, with Azure and Bicep given first-class support alongside Terraform, Kubernetes, and Helm.github.com · read 9 Oct 2026
- License and availability
- The core scanner, rule packs, and CI/CD integrations use Apache 2.0, and the self-hosted enterprise portal is source-available under the same license.github.com · read 9 Oct 2026
- Policy engine
- Policy rules are Rego evaluated by OPA and embedded at build time; scans have no network dependency.github.com · read 9 Oct 2026
- Portal authentication
- The portal uses HTTP Basic Auth for ingestion and supports per-user OIDC or Entra ID SSO when configured.github.com · read 9 Oct 2026
- Portal limitations
- The repository lists retention policy, attestation verification, and real multi-tenancy as unresolved portal questions.github.com · read 9 Oct 2026
- Purpose
- PolicyForge is an open-source policy-as-code scanner for infrastructure-as-code.github.com · read 9 Oct 2026
- Runtime requirements
- Helm charts are rendered through a locally installed `helm template`; without Helm, PolicyForge warns and skips charts it finds.github.com · read 9 Oct 2026
- Supply chain
- It generates an SBOM on every scan and supports SLSA provenance predicates and cosign signing and attestations.github.com · read 9 Oct 2026
- Supported formats
- It scans Terraform, Bicep, Kubernetes manifests, and Helm charts through a unified resource model.github.com · read 9 Oct 2026
