DEVOPSdigest

Modernizing access control and authorization is one of the next big frontiers for the software industry. Policy as code is being explored by the industry as an alternative or expansion upon the long-term standards of role-based access control and entitlements. With policy as code, policies can be managed and automated using code written in a high-level language. It is a programmatic method of uniformly defining and enforcing policies throughout cloud native applications and their infrastructure. Below is a summary of some of the key findings from Styra’s 2023 State of Policy as Code Report.

Homegrown Authorization Is Insufficient and Policy as Code Is Vital

86% face challenges with implementing authorization. The biggest challenges were:

■ Lack of alignment between teams (e.g., different or individualized approaches to authorization, 34%)

■ Lack of visibility into … implementation, enforcement, monitoring, and reporting (31%)

■ Lack of consistent or centralized policy development and management lifecycle; difficulty meeting security, compliance, or auditability requirements (29%)

61% agree homegrown authorization is inefficient and wastes the developer’s time.

Many agree that policy as code is a vital component of preventive security and compliance at scale (94%), speeds up time to market (96%), and makes work easier for developers (91%).

Policy as Code Is Expanding with Open Policy Agent Leading the Way

55% write and enforce policy as code to manage authorization in their day-to-day work, while only 41% are using homegrown authorization solutions. Even still, it’s a relatively new adoption, with 51% having only adopted policy as code in the past two years.

The growth of policy as code was made possible by open source tools such as the Open Policy Agent (OPA), with 46% of those who use policy as code relying on OPA in some form, more than triple the usage of the next leading technology.

Organizations Are Trying to Scale Policy as Code Adoption

Even for those organizations who have adopted policy as code, they are still working to scale their usage:

■ More teams

■ More infrastructure — currently, 66% use it for AWS CloudFormation checks, 60% for HashiCorp Terraform checks, 45% for infrastructure compliance monitoring

■ More applications — currently, 55% are securing API gateways, 52% implement role-based access control (RBAC), 46% implement attribute-based access control (ABAC)

■ More production and mission-critical systems — currently, only 30% are using for most or all non-mission and mission-critical systems, with 57% in a more limited capacity and 9% exploring but have not yet deployed in production

83% of organizations plan to invest somewhat or significantly more in policy as code.

High-revenue organizations show a more sophisticated, mature approach to policy as code compared to lower-grossing companies. Organizations that make $500 million or less in revenue are most likely to use policy as code in production, but only with limited non-mission critical systems. On the flip side, organizations making $501 million or more are most likely to use policy as code in a significant capacity, with both non-mission and mission-critical systems.

Organizations Need Help with Their Policy as Code Adoption

94% of organizations view policy as code as a strategic priority. However, adopting policy as code is complex — socially and technically.

The biggest social barriers include the complexity of digital transformation projects (28%), organizational resistance to change (27%), and a lack of awareness of policy as code (26%).

The biggest technical barriers include writing efficient policies as code (27%), and data fetch latency (26%)

The expansion and growing maturity of Policy as Code points to significant tailwinds for modernizing and transforming current authorization approaches. Policy as Code enables organizations to reify their current access control models as code — role-based, attribute-based, entitlements, and relationship-based — while setting them up to develop more mature policies using more fine-grained rules and contextual data. The findings from Styra’s State of Policy as Code Report show that we can expect to see an acceleration of this modernization transformation.