Getting started with Open Policy Agent (OPA) to improve your cloud security

Learn Rego basics from Wiz to express policy as code for your cloud security.

CSPM (Cloud Security Posture Management) tools have made it easier for businesses to reduce risks in the cloud. One key component of this has been setting the right policies to safeguard organizations for their cloud infrastructure and applications. It is often overlooked how these policies are created and what goes into customizing them. We use Rego, the language used byOPA(Open Policy Agent), to write these policies because Rego is easy to use and highly scalable. To fully understand Rego, let us go over a few basics.

What is OPA and why should you use Rego

Rego is a policy language that supportsOpen Policy Agent (OPA)and is used to write policies across the cloud stack. At its core, Rego inspects and transforms data, allowing OPA to make policy decisions. Rego, created byStyra, was built for authorization, and was designed to help users expresspolicy as code.

At Styra, we are empowering organizations to more easily build authorization policy that is easy to read and write. Wiz’s use of Rego to configure CSPM checks on cloud resources is a notable example of how we are enabling DevOps, security, and compliance teams to democratize policy and protect their cloud environments.

At Wiz, we provide customers with thousands of built-in policies to protect them from potential cloud security risks. Customers who prefer to write their own policies can leverage Rego to tune Wiz for their needs.

How to write your first OPA policy

As an example, the policy shown below checks to ensure that the IP ranges of an AWS security group restricts outbound traffic to the public internet. To fully understand this OPA policy, let us go through each line step-by-step.

Line 1: Every Rego policy has a package name that defines the scope of that policy.

Line 3: Import future.keyworks package into the scope of this policy so it can be referred to.

Line 5: Define default result as pass.

Line 7: IPs is a variable that represents all internet IP ranges.

Line 9: Result will fail if the condition inside the bracket is true.

Lines 10-11: Input.IpPermissionsEgress[permission] is running a loop for every Egress rule. And then we are calling the unrestrictedDestinationIPs function for each of those Egress rules.

Lines 14-18: The function unrestrictedDestinationIPs returns a boolean value “true” if the Egress rule allows all internet IP ranges.

To help you get started, we have developed aRego guideto help you write policies for your business needs. You can also visitStyra Academyand take a course covering the topic or visit theRego Playgroundto try Rego in a hands-on lab environment.

Simplify and centralize security and compliance management by sending audit-worthy events from Wiz into AWS CloudTrail Lake.

Shell commands that once had to be run manually now can be coded into a custom rule and run daily using Wiz agentless workload scanning.

Learn how to improve cluster security with user namespaces, a new feature introduced in Kubernetes v1.25.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings