In modern cloud environments, compliance must come built in. You can’t leave it until the last step anymore. Teams now work with Zero Trust, multi-cloud, and AI workloads daily. With this shift, security teams face growing pressure. They must enforce rules across thousands of cloud resources. And they must do it without slowing the pace of delivery. That’s where Compliance as Code becomes essential. In this guide, you’ll learn how to automate policies using Terraform and Google Cloud’s Policy Intelligence. This helps you find issues early, fix drift, and stay compliant in every CI/CD run, no matter your scale. Why Compliance as Code Matters Compliance today needs to be fast, flexible, and built-in. Below are the key reasons why teams now rely on Compliance as Code. Manual audits don’t scale with fast infrastructure changes: Cloud setups change by the minute, but audits stay slow. You can’t rely on human checks in dynamic environments.
Modern regulations need continuous enforcement: Standards like NIS2 and PCI DSS 4.0 need regular checks. One-time reviews won’t keep you compliant anymore.
Infrastructure is now written as code: Teams use Terraform or scripts to build everything. Compliance must plug directly into these workflows to be effective.
Agentless detection is the new standard: You now need tools that work without agents. They must spot issues before they hit production. Manual audits don’t scale with fast infrastructure changes: Cloud setups change by the minute, but audits stay slow. You can’t rely on human checks in dynamic environments. Manual audits don’t scale with fast infrastructure changes Modern regulations need continuous enforcement: Standards like NIS2 and PCI DSS 4.0 need regular checks. One-time reviews won’t keep you compliant anymore. Modern regulations need continuous enforcement Infrastructure is now written as code: Teams use Terraform or scripts to build everything. Compliance must plug directly into these workflows to be effective. Infrastructure is now written as code Agentless detection is the new standard: You now need tools that work without agents. They must spot issues before they hit production. Agentless detection is the new standard What is Google Cloud Policy Intelligence? Google Cloud Policy Intelligence is a built-in security suite. It helps you test, manage, and improve access policies easily. These tools give clear answers about who can access what. As of 2025, it includes: Feature

Description



Policy Analyzer

Analyze who has access to what and why.



Policy Simulator

Test the impact of IAM changes before deployment.



Recommender

Suggests least-privilege policy optimizations.



Policy Troubleshooter

Explains why access is denied or granted. Feature

Description



Policy Analyzer

Analyze who has access to what and why.



Policy Simulator

Test the impact of IAM changes before deployment.



Recommender

Suggests least-privilege policy optimizations.



Policy Troubleshooter

Explains why access is denied or granted. Feature

Description Feature Feature Feature Description Description Description Policy Analyzer

Analyze who has access to what and why. Policy Analyzer Policy Analyzer Analyze who has access to what and why. Analyze who has access to what and why. Policy Simulator

Test the impact of IAM changes before deployment. Policy Simulator Policy Simulator Test the impact of IAM changes before deployment. Test the impact of IAM changes before deployment. Recommender

Suggests least-privilege policy optimizations. Recommender Recommender Suggests least-privilege policy optimizations. Suggests least-privilege policy optimizations. Policy Troubleshooter

Explains why access is denied or granted. Policy Troubleshooter Policy Troubleshooter Explains why access is denied or granted. Explains why access is denied or granted. You can run all tools using APIs or Terraform scripts. That means you can automate policy checks across your cloud setup. Terraform + Policy Intelligence: Compliance Automation Stack High-Level Architecture This section shows how you can automate compliance using Terraform and Google Cloud Policy Intelligence. It outlines a high-level process that brings policy into code, tests it early, and fixes drift automatically. The flow supports security and speed at the same time. You define your policies using Terraform and push changes. The Policy Simulator checks the impact before anything merges. Then, analyzers and recommenders validate and optimise the access settings. Finally, alerts and auto-remediation fix any drift without manual steps. This full stack works inside CI/CD pipelines. It helps you enforce compliance continuously across your Google Cloud setup. Real-World Use Case: Enforcing Least Privilege Across Projects You need to control who accesses BigQuery in production. Only certain service accounts, the ones with specific tags, should have access. Here’s a clear breakdown of how you can set that up. Objective: Allow access to BigQuery only for approved accounts
Protect production data from unauthorised access
Apply one security rule across all GCP projects Allow access to BigQuery only for approved accounts Protect production data from unauthorised access Apply one security rule across all GCP projects How You Do It (Strategy) Use Terraform to write access policies as code
resource.matchTag('TAGKEY_ID', 'prod')



Tag each trusted service account with a tag like env=prod


Write IAM rules that only allow access if the tag matches Use Terraform to write access policies as code
resource.matchTag('TAGKEY_ID', 'prod') Use Terraform to write access policies as code resource.matchTag('TAGKEY_ID', 'prod') resource.matchTag('TAGKEY_ID', 'prod') Tag each trusted service account with a tag like env=prod Tag each trusted service account with a tag like env=prod Write IAM rules that only allow access if the tag matches Write IAM rules that only allow access if the tag matches Before You Deploy (Testing) Run the Policy Simulator to test the new rule


Make sure no unlabelled accounts are allowed access


Fix any issues before changes go live
After You Deploy (Monitoring)


Use Policy Analyzer to check who still has access


If someone has access without the right tag, raise a flag


Set up alerts to catch any unwanted changes in permissions Run the Policy Simulator to test the new rule Run the Policy Simulator to test the new rule Make sure no unlabelled accounts are allowed access Make sure no unlabelled accounts are allowed access Fix any issues before changes go live
After You Deploy (Monitoring) Fix any issues before changes go live After You Deploy (Monitoring) Use Policy Analyzer to check who still has access Use Policy Analyzer to check who still has access If someone has access without the right tag, raise a flag If someone has access without the right tag, raise a flag Set up alerts to catch any unwanted changes in permissions Set up alerts to catch any unwanted changes in permissions Step-by-Step: Implementing Compliance as Code on GCP Learn how to turn security rules into code using Terraform and GCP tools. This process helps you automate, validate, and enforce compliance at scale. 1. Codify IAM with Terraform Write your IAM policies as code using Terraform. This lets you manage access rules consistently across all cloud projects.
resource "google_project_iam_member" "prod_bq_access" {
  project = "prod-data-analytics"
  role	= "roles/bigquery.dataViewer"
  member  = "serviceAccount:sa-prod@appspot.gserviceaccount.com"
}



While writing the IAM policies, consider additional least-privilege roles for CI users.


Minimum roles like BigQuery Data Editor (for Analyzer exports) and Cloud Asset Viewer
gcloud services enable \
  policysimulator.googleapis.com \
  cloudasset.googleapis.com \
  recommender.googleapis.com



Enable APIs (once per project/org): Policy Simulator, Cloud Asset Inventory, Recommender Write your IAM policies as code using Terraform. This lets you manage access rules consistently across all cloud projects.
resource "google_project_iam_member" "prod_bq_access" {
  project = "prod-data-analytics"
  role	= "roles/bigquery.dataViewer"
  member  = "serviceAccount:sa-prod@appspot.gserviceaccount.com"
} Write your IAM policies as code using Terraform. This lets you manage access rules consistently across all cloud projects. resource "google_project_iam_member" "prod_bq_access" {
  project = "prod-data-analytics"
  role	= "roles/bigquery.dataViewer"
  member  = "serviceAccount:sa-prod@appspot.gserviceaccount.com"
} resource "google_project_iam_member" "prod_bq_access" {
  project = "prod-data-analytics"
  role	= "roles/bigquery.dataViewer"
  member  = "serviceAccount:sa-prod@appspot.gserviceaccount.com"
} While writing the IAM policies, consider additional least-privilege roles for CI users. While writing the IAM policies, consider additional least-privilege roles for CI users. Minimum roles like BigQuery Data Editor (for Analyzer exports) and Cloud Asset Viewer
gcloud services enable \
  policysimulator.googleapis.com \
  cloudasset.googleapis.com \
  recommender.googleapis.com Minimum roles like BigQuery Data Editor (for Analyzer exports) and Cloud Asset Viewer gcloud services enable \
  policysimulator.googleapis.com \
  cloudasset.googleapis.com \
  recommender.googleapis.com gcloud services enable \
  policysimulator.googleapis.com \
  cloudasset.googleapis.com \
  recommender.googleapis.com Enable APIs (once per project/org): Policy Simulator, Cloud Asset Inventory, Recommender Enable APIs (once per project/org): Policy Simulator, Cloud Asset Inventory, Recommender 2. Pre-Deploy Simulation with Policy Simulator Use Policy Simulator to test IAM changes before deployment. It helps catch mistakes and verify access rules early.
gcloud policy-intelligence simulations create \
  --policy-file=iam-policy.json \
  --project=prod-data-analytics



Check who will gain or lose access:
gcloud policy-intelligence simulations get SIMULATION_ID



Automate this check in your CI pipeline to block misconfigured roles before deployment. Use Policy Simulator to test IAM changes before deployment. It helps catch mistakes and verify access rules early.
gcloud policy-intelligence simulations create \
  --policy-file=iam-policy.json \
  --project=prod-data-analytics Use Policy Simulator to test IAM changes before deployment. It helps catch mistakes and verify access rules early. gcloud policy-intelligence simulations create \
  --policy-file=iam-policy.json \
  --project=prod-data-analytics gcloud policy-intelligence simulations create \
  --policy-file=iam-policy.json \
  --project=prod-data-analytics Check who will gain or lose access:
gcloud policy-intelligence simulations get SIMULATION_ID Check who will gain or lose access: gcloud policy-intelligence simulations get SIMULATION_ID gcloud policy-intelligence simulations get SIMULATION_ID Automate this check in your CI pipeline to block misconfigured roles before deployment. Automate this check in your CI pipeline to block misconfigured roles before deployment. 3. Detect Overprovisioning with IAM Recommender After deployment, use Recommender to review permissions. It highlights accounts with more access than they need.
gcloud recommender recommendations list \
  --project=prod-data-analytics \
  --location=global \
  --recommender=google.iam.policy.Recommender



Then automatically apply recommendations:
gcloud recommender recommendations apply RECOMMENDATION_ID



This step reduces lateral movement risk and aligns with Zero Trust. After deployment, use Recommender to review permissions. It highlights accounts with more access than they need.
gcloud recommender recommendations list \
  --project=prod-data-analytics \
  --location=global \
  --recommender=google.iam.policy.Recommender After deployment, use Recommender to review permissions. It highlights accounts with more access than they need. gcloud recommender recommendations list \
  --project=prod-data-analytics \
  --location=global \
  --recommender=google.iam.policy.Recommender gcloud recommender recommendations list \
  --project=prod-data-analytics \
  --location=global \
  --recommender=google.iam.policy.Recommender Then automatically apply recommendations:
gcloud recommender recommendations apply RECOMMENDATION_ID Then automatically apply recommendations: gcloud recommender recommendations apply RECOMMENDATION_ID gcloud recommender recommendations apply RECOMMENDATION_ID This step reduces lateral movement risk and aligns with Zero Trust. This step reduces lateral movement risk and aligns with Zero Trust. 4. Audit Access with Policy Analyzer Use Policy Analyzer to see who can access what. It checks IAM settings across your cloud environment in seconds. You can filter by resource, user, or project scope. This helps spot unexpected access or overly broad permissions fast. For instance. gcloud asset analyze-iam-policy \
  --full-resource-name=//bigquery.googleapis.com/projects/prod-data-analytics \
  --permissions="bigquery.jobs.create" gcloud asset analyze-iam-policy \
  --full-resource-name=//bigquery.googleapis.com/projects/prod-data-analytics \
  --permissions="bigquery.jobs.create" Use this weekly to generate a compliance report. 5. Auto-Remediate with Terraform and CI/CD Add policy checks into your CI/CD pipeline for control. Use tools like Sentinel or GitHub Actions to fix drift fast.
jobs:
  simulate-policy:
	steps:
  	- name: Run Policy Simulator
    	run: |
      	gcloud policy-intelligence simulations create \
      	--policy-file=iam-policy.json \
      	--project=$PROJECT_ID



CI/CD note -  Use gcloud policy-intelligence simulate orgpolicy as a presubmit gate for org policy changes, and invoke the Policy Simulator Replays REST API for IAM allow-policy what-if checks. Add policy checks into your CI/CD pipeline for control. Use tools like Sentinel or GitHub Actions to fix drift fast.
jobs:
  simulate-policy:
	steps:
  	- name: Run Policy Simulator
    	run: |
      	gcloud policy-intelligence simulations create \
      	--policy-file=iam-policy.json \
      	--project=$PROJECT_ID Add policy checks into your CI/CD pipeline for control. Use tools like Sentinel or GitHub Actions to fix drift fast. jobs:
  simulate-policy:
	steps:
  	- name: Run Policy Simulator
    	run: |
      	gcloud policy-intelligence simulations create \
      	--policy-file=iam-policy.json \
      	--project=$PROJECT_ID jobs:
  simulate-policy:
	steps:
  	- name: Run Policy Simulator
    	run: |
      	gcloud policy-intelligence simulations create \
      	--policy-file=iam-policy.json \
      	--project=$PROJECT_ID CI/CD note -  Use gcloud policy-intelligence simulate orgpolicy as a presubmit gate for org policy changes, and invoke the Policy Simulator Replays REST API for IAM allow-policy what-if checks. CI/CD note -  Use gcloud policy-intelligence simulate orgpolicy as a presubmit gate for org policy changes, and invoke the Policy Simulator Replays REST API for IAM allow-policy what-if checks. CI/CD note gcloud policy-intelligence simulate orgpolicy Replays Compliance as Code Checklist for GCP This table shows each step for enforcing compliance as code. It links every checkpoint with the right automation tool. You’ll see how to write rules, test changes, and track access. Each tool helps you stay secure and audit-ready at scale. Checkpoint

Automation Tool



Codify IAM + Org Policies

Terraform



Simulate Policy Changes

Policy Simulator API



Least Privilege Optimization

IAM Recommender



Access Audits & Reporting

Policy Analyzer



Alerting on Drift

CI/CD + Cloud Logging + Pub/Sub



Compliance Evidence Export

BigQuery + Scheduled Reports Checkpoint

Automation Tool



Codify IAM + Org Policies

Terraform



Simulate Policy Changes

Policy Simulator API



Least Privilege Optimization

IAM Recommender



Access Audits & Reporting

Policy Analyzer



Alerting on Drift

CI/CD + Cloud Logging + Pub/Sub



Compliance Evidence Export

BigQuery + Scheduled Reports Checkpoint

Automation Tool Checkpoint Checkpoint Checkpoint Automation Tool Automation Tool Automation Tool Codify IAM + Org Policies

Terraform Codify IAM + Org Policies Codify IAM + Org Policies Terraform Terraform Simulate Policy Changes

Policy Simulator API Simulate Policy Changes Simulate Policy Changes Policy Simulator API Policy Simulator API Least Privilege Optimization

IAM Recommender Least Privilege Optimization Least Privilege Optimization IAM Recommender IAM Recommender Access Audits & Reporting

Policy Analyzer Access Audits & Reporting Access Audits & Reporting Policy Analyzer Policy Analyzer Alerting on Drift

CI/CD + Cloud Logging + Pub/Sub Alerting on Drift Alerting on Drift CI/CD + Cloud Logging + Pub/Sub CI/CD + Cloud Logging + Pub/Sub Compliance Evidence Export

BigQuery + Scheduled Reports Compliance Evidence Export Compliance Evidence Export BigQuery + Scheduled Reports BigQuery + Scheduled Reports GCP Compliance as Code Pipeline Conclusion Manual compliance doesn’t work in fast-moving cloud setups. Google Cloud Policy Intelligence helps you shift from audits to automation. You get real-time checks powered by data and machine learning. Whether you’re an engineer or architect, code-based compliance helps. It keeps your GCP secure, audit-ready, and least-privilege aligned. When you combine Terraform with Policy Intelligence, you build trust. You're not just setting rules, you're automating them at scale.

This story contains AI-generated text. The author has used AI either for research, to generate outlines, or write the text itself. 

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

Terra

Google

Compliance Doesn’t Have to Be Boring: Automate It with Terraform on GCP

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

Best Practices for Securing Cloud Environments Against Cyber Threats

Essential Aspects of Cloud Compliance for Financial Services

How to Automate Google Cloud Security Audits with Terraform and Python

Enterprise Compliance Innovation: Yogesh Gadhiya's AWS Integrated Monitoring System

The Devil in the Skies

Best Practices for Securing Cloud Environments Against Cyber Threats

Essential Aspects of Cloud Compliance for Financial Services

How to Automate Google Cloud Security Audits with Terraform and Python

Enterprise Compliance Innovation: Yogesh Gadhiya's AWS Integrated Monitoring System

The Devil in the Skies

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps