PolicyForge

Spec sheet

Purpose

PolicyForge is an open-source policy-as-code scanner for infrastructure-as-code.Read 9 Oct 2026 · github.com

Intended users

The project is aimed at teams scanning infrastructure-as-code, with Azure and Bicep given first-class support alongside Terraform, Kubernetes, and Helm.Read 9 Oct 2026 · github.com

Built-in policies

The project lists 11 built-in rules covering Azure CIS Foundations, AWS, and Kubernetes Pod Security.Read 9 Oct 2026 · github.com

CI/CD integrations

The repository describes a GitHub Action that uploads SARIF to GitHub code scanning and an Azure DevOps task that publishes SARIF as a build artifact.Read 9 Oct 2026 · github.com

Custom rules

Users can add `.rego` rules at scan time with `--policy-dir` without forking or rebuilding.Read 9 Oct 2026 · github.com

Drift detection

It compares declared infrastructure code with live Azure state through Resource Graph, limited to resource types and attributes its rules understand.Read 9 Oct 2026 · github.com

Enterprise portal

An optional self-hosted portal provides a dashboard, audit trail, org-wide policy management, and SOC2/PCI compliance rollups.Read 9 Oct 2026 · github.com

License and availability

The core scanner, rule packs, and CI/CD integrations use Apache 2.0, and the self-hosted enterprise portal is source-available under the same license.Read 9 Oct 2026 · github.com

Policy engine

Policy rules are Rego evaluated by OPA and embedded at build time; scans have no network dependency.Read 9 Oct 2026 · github.com

Portal authentication

The portal uses HTTP Basic Auth for ingestion and supports per-user OIDC or Entra ID SSO when configured.Read 9 Oct 2026 · github.com

Portal limitations

The repository lists retention policy, attestation verification, and real multi-tenancy as unresolved portal questions.Read 9 Oct 2026 · github.com

Runtime requirements

Helm charts are rendered through a locally installed `helm template`; without Helm, PolicyForge warns and skips charts it finds.Read 9 Oct 2026 · github.com

Supply chain

It generates an SBOM on every scan and supports SLSA provenance predicates and cosign signing and attestations.Read 9 Oct 2026 · github.com

Supported formats

It scans Terraform, Bicep, Kubernetes manifests, and Helm charts through a unified resource model.Read 9 Oct 2026 · github.com

Plans and prices

Every PolicyForge plan and price →

Where Specifiction places it

• Infrastructure Policy as Code Tools#16 of 257.4