A password is a secret, and a secret can be lost, stolen or traded on dark web marketplaces. Most engineers know this, that’s why every SSH tutorial begins with the instructions for disabling passwords and enabling private/public key pairs. But a private key is just another form of a secret. In this article, I will try to explain why all forms of secrets are bad for you.

IaC (infrastructure as code) is the latest tool to transform the face of IT infrastructure – in a nutshell, it means managing and provisioning infrastructure through code instead of manual processes. IaC provides developers with a blueprint that allows them to create tools and provision infrastructure on-demand while staying in control, increasing efficiency, and maintaining consistency when deploying updates and changes.

In Tim Hinrich’s prior blog titled the Three-Body Problem for Policy, he dives into the interconnected relationship between policy, data and software. He identifies a key consideration when using OPA — that “policies can only be evaluated when provided with the correct data.” The full blog is well worth the read to better understand the role of data and its correctness in your policy implementation.