# Example Kong plugin configuration for PCI DSS compliance
plugins:
  - name: request-transformer
    config:
      remove:
        headers: ["authorization"]
  - name: response-transformer
    config:
      remove:
        json: ["$.card.number", "$.card.cvv"]
  - name: rate-limiting
    config:
      second: 5
      minute: 60
  - name: ip-restriction
    config:
      whitelist: ["192.168.1.1/24", "10.0.0.1/16"]
  - name: key-auth
    config:
      key_names: ["api-key"]
  - name: acl
    config:
      whitelist: ["admin", "payment-service"]
  - name: log
    config:
      service_token: "log-token"
      log_level: "info"
```

This approach provides:

- Centralized policy management
- Consistent enforcement across services
- Automated testing of policies
- Clear audit trails

### Policy as code

Policy-as-code tools like Open Policy Agent (OPA) allow you to define compliance policies as code that can be versioned, tested, and automated.

The policies are written in a declarative language called Rego, which is designed to remove ambiguity and make policies machine-readable. By removing policy enforcement from the application code, you can ensure that compliance requirements are consistently enforced across all services and updated independently of the application code.

```rego