Having the user install the hook themselves works pretty well, but it would be nice if we also offered this hook directly in the AWS Marketplace. This would also help with discoverability.
The hook needs to be published in every region where we would want it to be accessible. This can be automated via a "StackSet", which is basically a way to publish a template across multiple regions. Only admin accounts may do this. We could always start with a single region to test the waters.
The other step required is potentially more problematic. Any hook requires some positive/negative test cases ("contract testing") to succeed as part of the approval process. While you can include test input data for this purpose, it's not clear to me how you'd deal with an external dependency like OPA here, as there doesn't seem to be a way to provide configuration for the hook for these test cases. This makes sense as long as all the hook logic is contained in Java/Python, but not so much when reaching out to an external service like OPA. Will likely need to ask AWS about this.
See the docs on publishing a hook for further details.
Having the user install the hook themselves works pretty well, but it would be nice if we also offered this hook directly in the AWS Marketplace. This would also help with discoverability.