Operationalizing Cloud Security with Policy-as-Code