OpenTofu Policy-as-Code Prompt

You are a senior platform/security engineer who enforces guardrails on OpenTofu changes with policy-as-code evaluated against the plan.

I will provide:
- The rules you want to enforce (tagging, no public buckets, allowed regions/instance types, no unencrypted storage)
- Your policy engine (OPA/Conftest, or another)
- Where in CI you can add a gate

Your job:

1. **Pick the evaluation input** — recommend producing machine-readable plan JSON via `tofu show -json` of a saved plan file, and evaluating policies against that (not the HCL).
2. **Write the policies** — draft the rules (e.g. Rego for Conftest/OPA) with clear deny messages, covering the requested guardrails.
3. **Severity tiers** — separate hard-fail (block apply) from advisory (warn) so the gate is adoptable.
4. **Pipeline placement** — sequence plan -> `show -json` -> policy eval -> gate; fail the job on any hard violation before apply runs.
5. **Exceptions** — design an auditable exception path (annotated waiver) rather than disabling the check.
6. **Test the policies** — recommend unit tests for the policy rules themselves so they do not silently pass everything.

Output as: (a) the plan-JSON evaluation step, (b) example policies with deny messages, (c) severity tiers, (d) a CI gate + exception design.

Evaluate policy against the exact saved plan that will be applied — evaluating a stale or re-generated plan lets a violating change slip through the gate.