v1.11.0: Policy as Code
Policies validate what a plan is allowed to contain before it is applied — or destroyed. A hard violation refuses the job before anything reaches the infrastructure; a soft violation records a warning and lets the job continue.
Full notes: 1.11.0 on GitHub.
Terraform and OpenTofu
OPA/Rego policies are evaluated with conftest against the JSON export of the binary plan. conftest's conventions are adopted wholesale — deny* and violation* are hard, warn* is soft, all prefix-matched across every namespace — so existing conftest policy repos work unchanged, and policies written for Snap CD stay runnable under plain conftest in CI.
Pulumi
CrossGuard policy packs are enforced inside the preview via --policy-pack. A mandatory violation fails the preview, and the job finalizes exactly as a Terraform denial does.
Attaching a policy
Policies attach to a Module or a Namespace, in three source flavours:
inline— a policy document held in Snap CDremote— a git subtree at a pinned revisionlocal— an operator-managed folder on the Runner
Severity lives in the policy content rather than on the resource. evaluate_on scopes Terraform policies to apply, destroy or both, making destroy protection a first-class case.
Denial is a refusal, not a failure
Jobs finish in a new PolicyDenied state alongside Declined. The approvals screen shows the outcome, the plan's change counts, and links into the policy logs.
Evaluation happens on the Runner against the plan the job actually produced, and the plan document never leaves the Runner.
For operators
The Runner image now carries conftest and python3/venv; the pulumi CLI already ships CrossGuard. Air-gapped runners can pre-provision CrossGuard packs and set PolicyEvaluation:PackProvisioningEnabled=false.
Intelligent GitOps for Infrastructure as Code. Automate, orchestrate, and scale your infrastructure deployments with confidence.
© 2026 Snap CD. All rights reserved.