AXIOM THREAT DESK · COUNTERMEASURE & GUARDRAIL STUDIO

Automated Security Countermeasure & Policy Guardrails

Deterministic policy-as-code artifacts generated directly from STRIDE findings for Open Policy Agent (OPA), Terraform, and Envoy service mesh.

OPA Rego · Kubernetes AdmissionEnforced

Deny Privileged Pods & Wildcard ServiceAccount ClusterRoles

Mitigates: STRIDE-E2 (Elevation of Privilege)

package axiom.stride.elevation
deny[msg] {
  input.request.kind.kind == "ClusterRoleBinding"
  input.request.object.roleRef.name == "cluster-admin"
  msg := "STRIDE-E2 Violation: Wildcard cluster-admin binding blocked"
}

Terraform Sentinel · AWS KMS & S3Enforced

Enforce S3 WORM Object Lock & KMS Customer-Managed Key

Mitigates: STRIDE-R1 (Repudiation) & STRIDE-T2 (Tampering)

resource "aws_s3_bucket_object_lock_configuration" "audit_worm" {
  bucket = aws_s3_bucket.audit_ledger.id
  rule {
    default_retention { mode = "COMPLIANCE" days = 365 }
  }
}