Policy as Code for service accounts

Learn how to use policy as code for a service account.

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

You can create a policy and apply it to all Service Accounts. The policy is evaluated during Service account-level events, such as 'On Save,' which happens when a Service account is created or updated. For more details, check out the Harness Governance Quickstart.

Before you begin

Review the following resources:

• Harness Governance Overview

• Harness Governance Quickstart

• Policies use the OPA authoring language Rego. Go to OPA Policy Authoring to learn Rego syntax.

Step 1: Add a policy

Follow these steps to add a policy:

1. In Harness, go to Account Settings → Policies → New Policy.

   

   opa-navigation
2. The New Policy settings will appear.

   Enter a Name for your policy → click Apply.

   

   opa-create-policy
3. Next, add your Rego policy.

   For example, add a policy to prevent users from creating a service account with names having "success" in it, like 'pipeline-success' or 'successfuldeploy' and so on.

   package opaexamplepolicy  
   
   deny[msg] {
       contains(input.serviceAccount.name, "success")
       #input.serviceAccount.name == "word"
       msg = sprintf("CONTAINS Service account name '%s' contains the forbidden word 'success'.", [input.serviceAccount.name])
   }

   click Save

   

   opa-save-policy

Step 2: Add the policy to a policy set

After creating your policy, add it to a Policy Set before applying it to your Service Account.

Follow these steps to add the policy to a policy set:

1. In Policies, click Policy Sets .

   

   opa-select-policy-sets
2. Click New Policy Set, Enter a Name and Description for the Policy Set.

   In Entity type, select Service Account.

   

   opa-service-setting

   In On what event should the Policy Set be evaluated, select On save. → Continue.

   IMPORTANT

   Existing service accounts are not automatically updated with policies. Policies are applied only when they are created or updated.

Step 3: Select policy evaluation criteria

Follow these steps to select the policy evaluation criteria:

1. Click Add Policy in Policy evaluation criteria.

   Select the policy from the list.

   

   select-opa-policy
2. Choose the severity and action for policy violations.

   You can select one of the following

   • Warn & continue - You will receive a warning if the policy is not met when the Service Account is evaluated, but the Service Account will be saved and you may proceed.

   • Error and exit - You'll get an error and be exited without saving the Service Account if the policy isn't met when the Service Account is examined.

   

   opa-apply-severity

   Click Apply, and then click Finish.

Step 4: Policy enforcement

By default, the policy set is enforced:

1. Now, your Policy Set is automatically set to Enforced, to make it unenforced, toggle off the Enforced button.

   

Step 5: Apply a policy to a service account

Follow these steps to apply the policy to a service account:

• After creating your Policy Set and adding policies, apply it to a service account.

  You can add a Service Account from any module in your Project in Project setup, or in your Organization, or Account Resources.

1. "Go to Account Settings → Access Control → Service Account

   click New Service Account.

   Try using a name denied by your policy, e.g., "successfuldeploy"."

   Based on your selection in the Policy Evaluation criteria, you will either receive a warning or an error.

   

Explore more on Harness policy as code

Go to the following resource for related reading:

• Harness Policy As Code Overview