Make Your Security Policy Auditable
summary
Claims that externalizing authorization makes policies auditable and reviewable, demonstrating a concrete migration from a Spring Boot/Kotlin app to Open Policy Agent with policies in Rego, an API gateway (APISIX) fronting services, and data stored in API6 + etcd bundles. The demo shows authorization via a REST call to OPA—slower but functionally equivalent—plus a change data capture job that syncs identities into the gateway; remaining work: automated bundle regeneration and Rego adoption limits.
AI-written summary · about
chapters (12)
- 0:00Auditable security policies intro
- 2:11Why policies fail in practice
- 3:59Spring Security RBAC limits
- 6:28Live Spring Security demo
- 10:05Auditing compiled policies challenges
- 11:31Policy as code with OPA Rego
- 14:27Decoupling policy from code
- 16:36Storing policy bundles with API6
- 17:39Moving auth out of code
- 21:10Simplified architecture with API6 OPA
- 23:18Limitations and future work
- 23:40Summary and call to action
related talks
37mMake your security policy auditable
25mThe right feature at the right place: the example of authorization
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
32mOPA: So What Does the Policy Do?
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
36mOpen Policy Agent: security for cloud natives and everyone else
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
16mDistributed application level RBAC with OPA