What if every deploy proved its own compliance?

# Compliance-ready S3 bucket with evidence collection
module "secure_bucket" {
  source  = "./modules/compliant-s3"

  name        = "audit-evidence"
  environment = "production"

  # Compliance controls - enabled by default
  encryption         = true
  versioning         = true
  access_logging     = true
  public_access_block = true

  # Evidence collection outputs SHA-256 checksums
  evidence_collection = true
}

# Outputs: Evidence package ready for audit
output "evidence_hash" { value = module.secure_bucket.evidence_sha256 }

# OPA policy for S3 bucket compliance validation
package aws.s3.compliance

import future.keywords.if
import future.keywords.in

# Deny buckets without encryption
deny[msg] if {
  bucket := input.resource
  bucket.type == "aws_s3_bucket"
  not bucket.encryption_enabled
  msg := sprintf("Bucket %s: encryption required", [bucket.name])
}

# Deny buckets with public access
deny[msg] if {
  bucket := input.resource
  bucket.type == "aws_s3_bucket"
  bucket.public_access == true
  msg := sprintf("Bucket %s: public access blocked", [bucket.name])
}

# Generate evidence on compliant resources
evidence[result] if {
  bucket := input.resource
  count(deny) == 0
  result := {"status": "compliant", "hash": sha256(bucket)}
}