Datadog IaC Security Now Accepts Custom Rego Rules — and Can Block PRs That Fail Them

Datadog IaC Security now supports custom rules written in Rego — the policy language from Open Policy Agent — applied at the pull request stage across six Infrastructure as Code platforms: Terraform, CloudFormation, Kubernetes manifests, Ansible, Dockerfiles, and GitHub Actions. When a PR Gate is configured as mandatory, non-compliant configurations block the merge.

This feature closes the enforcement gap in a common IaC security workflow. Teams running static analysis on infrastructure code have typically had two choices: use the platform’s built-in ruleset (comprehensive but not org-specific) or build a separate policy gate in the CI pipeline (flexible but disconnected from the observability stack). Datadog’s custom rules land in the IaC Security product directly, which means violations surface in the same place as cloud misconfiguration alerts, runtime anomalies, and posture findings.

The Configuration Model

Custom rules live in code-security.datadog.yaml — a configuration file checked into the repository that specifies which rule files apply, what enforcement level to use, and how to scope rules to specific paths or environments. This keeps the security policy definition in version control alongside the infrastructure code it governs, with the same review and audit trail.

Enforcement modes:

• Advisory (default): violations surface as warnings in PR comments and the Datadog dashboard; merges are not blocked
• Mandatory (PR Gate): violations block the merge; requires a passing result before the branch can land

The per-repo code-security.datadog.yaml configuration supports scoping rules to specific file paths, which lets platform teams apply different policy sets to production infrastructure versus development environments without maintaining separate repos.

Writing Custom Rules in Rego

Rego is the policy language from the Open Policy Agent ecosystem. Teams already using OPA for Kubernetes admission control, Terraform Cloud Sentinel policies, or Conftest validation will find the rule-writing model familiar. For teams new to Rego, Datadog provides a rule editor with testing support.

The rule structure covers the same IaC resources that Datadog’s built-in rules scan. A custom rule checking for specific tagging requirements, enforcing naming conventions, or detecting internal-only resource configurations follows the same Rego primitives (input, deny, violation) as OPA-based policies elsewhere in the stack.

The six supported platforms cover the main IaC footprint of most organizations:

• Terraform — primary for multi-cloud provisioning
• CloudFormation — AWS-native infrastructure
• Kubernetes manifests — workload configuration
• Ansible — configuration management and deployments
• Dockerfiles — image build security
• GitHub Actions — CI/CD pipeline security

Findings Automation Pipeline

Beyond PR Gates, custom rule violations integrate with Datadog’s findings workflow: violations create findings tracked in the security posture dashboard, can be routed to incident management, and support version history — so changes to which rules are active, and which resources were in violation at a given commit, are auditable.

IDE extensions and PR comments bring violations to developers before they reach the pipeline. The PR comment integration is particularly useful for the Advisory enforcement mode, where the goal is education and visibility rather than hard blocking — developers see exactly which Rego policy was violated, with the relevant resource and configuration section highlighted.

Source: Datadog Blog

Content created with AI assistance and reviewed for accuracy.