From b03b44ae46813ba7d8e18da2da7cf5d400239782 Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub Date: Fri, 7 Oct 2022 16:34:38 +0300 Subject: [PATCH 01/23] 1 --- external_data/random_decision1.rego | 27 +++++++++++++++++++++++++++ external_data/random_decision2.rego | 27 +++++++++++++++++++++++++++ external_data/random_decision3.rego | 27 +++++++++++++++++++++++++++ external_data/random_decision4.rego | 27 +++++++++++++++++++++++++++ external_data/scalr-policy.hcl | 20 ++++++++++++++++++++ 5 files changed, 128 insertions(+) create mode 100644 external_data/random_decision1.rego create mode 100644 external_data/random_decision2.rego create mode 100644 external_data/random_decision3.rego create mode 100644 external_data/random_decision4.rego diff --git a/external_data/random_decision1.rego b/external_data/random_decision1.rego new file mode 100644 index 0000000..968f304 --- /dev/null +++ b/external_data/random_decision1.rego @@ -0,0 +1,27 @@ +# This dummy policy makes a decision based on a number received from random.org service +# just to demonstrate possible usage of HTTP requests +# to fetch external data during policy evaluation. +# See + +package terraform + + +random_number = num { + request := { + "url": "https://www.random.org/integers/?num=1&min=0&max=9&base=10&col=1&format=plain", + "method": "GET" + } + response := http.send(request) + response.status_code == 200 + num := to_number(trim(response.raw_body, "\n")) +} + +deny[reason] { + number := random_number + number < 5 + + reason := sprintf( + "Unlucky you: got %d, but 5 or more is required", + [number] + ) +} diff --git a/external_data/random_decision2.rego b/external_data/random_decision2.rego new file mode 100644 index 0000000..968f304 --- /dev/null +++ b/external_data/random_decision2.rego @@ -0,0 +1,27 @@ +# This dummy policy makes a decision based on a number received from random.org service +# just to demonstrate possible usage of HTTP requests +# to fetch external data during policy evaluation. +# See + +package terraform + + +random_number = num { + request := { + "url": "https://www.random.org/integers/?num=1&min=0&max=9&base=10&col=1&format=plain", + "method": "GET" + } + response := http.send(request) + response.status_code == 200 + num := to_number(trim(response.raw_body, "\n")) +} + +deny[reason] { + number := random_number + number < 5 + + reason := sprintf( + "Unlucky you: got %d, but 5 or more is required", + [number] + ) +} diff --git a/external_data/random_decision3.rego b/external_data/random_decision3.rego new file mode 100644 index 0000000..968f304 --- /dev/null +++ b/external_data/random_decision3.rego @@ -0,0 +1,27 @@ +# This dummy policy makes a decision based on a number received from random.org service +# just to demonstrate possible usage of HTTP requests +# to fetch external data during policy evaluation. +# See + +package terraform + + +random_number = num { + request := { + "url": "https://www.random.org/integers/?num=1&min=0&max=9&base=10&col=1&format=plain", + "method": "GET" + } + response := http.send(request) + response.status_code == 200 + num := to_number(trim(response.raw_body, "\n")) +} + +deny[reason] { + number := random_number + number < 5 + + reason := sprintf( + "Unlucky you: got %d, but 5 or more is required", + [number] + ) +} diff --git a/external_data/random_decision4.rego b/external_data/random_decision4.rego new file mode 100644 index 0000000..968f304 --- /dev/null +++ b/external_data/random_decision4.rego @@ -0,0 +1,27 @@ +# This dummy policy makes a decision based on a number received from random.org service +# just to demonstrate possible usage of HTTP requests +# to fetch external data during policy evaluation. +# See + +package terraform + + +random_number = num { + request := { + "url": "https://www.random.org/integers/?num=1&min=0&max=9&base=10&col=1&format=plain", + "method": "GET" + } + response := http.send(request) + response.status_code == 200 + num := to_number(trim(response.raw_body, "\n")) +} + +deny[reason] { + number := random_number + number < 5 + + reason := sprintf( + "Unlucky you: got %d, but 5 or more is required", + [number] + ) +} diff --git a/external_data/scalr-policy.hcl b/external_data/scalr-policy.hcl index 0560865..1b12799 100644 --- a/external_data/scalr-policy.hcl +++ b/external_data/scalr-policy.hcl @@ -4,3 +4,23 @@ policy "random_decision" { enabled = true enforcement_level = "advisory" } + +policy "random_decision1" { + enabled = true + enforcement_level = "advisory" +} + +policy "random_decision2" { + enabled = true + enforcement_level = "advisory" +} + +policy "random_decision3" { + enabled = true + enforcement_level = "advisory" +} + +policy "random_decision4" { + enabled = true + enforcement_level = "advisory" +} From 6c3c3a03f5fd3d1ea57f8d608b21b426e2b4ddf0 Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub Date: Thu, 20 Oct 2022 13:45:08 +0300 Subject: [PATCH 02/23] Add dummy policies --- always_fail/scalr-policy.hcl | 6 ++++++ always_fail/test_fail.rego | 8 ++++++++ always_pass/scalr-policy.hcl | 6 ++++++ always_pass/test_pass.rego | 8 ++++++++ 4 files changed, 28 insertions(+) create mode 100644 always_fail/scalr-policy.hcl create mode 100644 always_fail/test_fail.rego create mode 100644 always_pass/scalr-policy.hcl create mode 100644 always_pass/test_pass.rego diff --git a/always_fail/scalr-policy.hcl b/always_fail/scalr-policy.hcl new file mode 100644 index 0000000..6ca0fae --- /dev/null +++ b/always_fail/scalr-policy.hcl @@ -0,0 +1,6 @@ +version = "v1" + +policy "test_fail" { + enabled = true + enforcement_level = "soft-mandatory" +} diff --git a/always_fail/test_fail.rego b/always_fail/test_fail.rego new file mode 100644 index 0000000..1a2eabf --- /dev/null +++ b/always_fail/test_fail.rego @@ -0,0 +1,8 @@ +package terraform + + +deny[reason] { + true + + reason := sprintf("Variables: %v",[tfplan.variables]) +} diff --git a/always_pass/scalr-policy.hcl b/always_pass/scalr-policy.hcl new file mode 100644 index 0000000..b40e3e4 --- /dev/null +++ b/always_pass/scalr-policy.hcl @@ -0,0 +1,6 @@ +version = "v1" + +policy "test_pass" { + enabled = true + enforcement_level = "soft-mandatory" +} diff --git a/always_pass/test_pass.rego b/always_pass/test_pass.rego new file mode 100644 index 0000000..112d2e6 --- /dev/null +++ b/always_pass/test_pass.rego @@ -0,0 +1,8 @@ +package terraform + + +deny[reason] { + false + + reason := sprintf("Variables: %v",[tfplan.variables]) +} From 5faaf708ae64c598e618ab3807114f0313d8521c Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub Date: Thu, 20 Oct 2022 14:00:14 +0300 Subject: [PATCH 03/23] Add dummy policies --- always_fail/test_fail.rego | 2 +- always_pass/test_pass.rego | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/always_fail/test_fail.rego b/always_fail/test_fail.rego index 1a2eabf..c83cc9c 100644 --- a/always_fail/test_fail.rego +++ b/always_fail/test_fail.rego @@ -4,5 +4,5 @@ package terraform deny[reason] { true - reason := sprintf("Variables: %v",[tfplan.variables]) + reason := sprintf("fail") } diff --git a/always_pass/test_pass.rego b/always_pass/test_pass.rego index 112d2e6..76e8eee 100644 --- a/always_pass/test_pass.rego +++ b/always_pass/test_pass.rego @@ -4,5 +4,5 @@ package terraform deny[reason] { false - reason := sprintf("Variables: %v",[tfplan.variables]) + reason := sprintf("pass") } From 7689d116691d6d17c4b1eadf044e93583736bfa1 Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub <44230643+lyzohub@users.noreply.github.com> Date: Thu, 20 Oct 2022 14:10:43 +0300 Subject: [PATCH 04/23] Update test_fail.rego --- always_fail/test_fail.rego | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/always_fail/test_fail.rego b/always_fail/test_fail.rego index 1a2eabf..c83cc9c 100644 --- a/always_fail/test_fail.rego +++ b/always_fail/test_fail.rego @@ -4,5 +4,5 @@ package terraform deny[reason] { true - reason := sprintf("Variables: %v",[tfplan.variables]) + reason := sprintf("fail") } From 62972229d447aa85e2facb10f09427a968d5785f Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub <44230643+lyzohub@users.noreply.github.com> Date: Thu, 20 Oct 2022 14:11:05 +0300 Subject: [PATCH 05/23] Update test_pass.rego --- always_pass/test_pass.rego | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/always_pass/test_pass.rego b/always_pass/test_pass.rego index 112d2e6..76e8eee 100644 --- a/always_pass/test_pass.rego +++ b/always_pass/test_pass.rego @@ -4,5 +4,5 @@ package terraform deny[reason] { false - reason := sprintf("Variables: %v",[tfplan.variables]) + reason := sprintf("pass") } From e873bb6bd36001138f3e103255890a6b549ed0b2 Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub <44230643+lyzohub@users.noreply.github.com> Date: Thu, 20 Oct 2022 14:24:24 +0300 Subject: [PATCH 06/23] Update test_fail.rego --- always_fail/test_fail.rego | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/always_fail/test_fail.rego b/always_fail/test_fail.rego index c83cc9c..26105f2 100644 --- a/always_fail/test_fail.rego +++ b/always_fail/test_fail.rego @@ -4,5 +4,5 @@ package terraform deny[reason] { true - reason := sprintf("fail") + reason := "fail" } From dce896b2458b5abcc46c7a6dc185325e22bdf84d Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub <44230643+lyzohub@users.noreply.github.com> Date: Mon, 24 Oct 2022 18:27:33 +0300 Subject: [PATCH 07/23] Update random_decision1.rego --- external_data/random_decision1.rego | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external_data/random_decision1.rego b/external_data/random_decision1.rego index 968f304..c8e0ddb 100644 --- a/external_data/random_decision1.rego +++ b/external_data/random_decision1.rego @@ -8,7 +8,7 @@ package terraform random_number = num { request := { - "url": "https://www.random.org/integers/?num=1&min=0&max=9&base=10&col=1&format=plain", + "url": "https://www.random.org/integers/?num=1&min=2&max=9&base=10&col=1&format=plain", "method": "GET" } response := http.send(request) @@ -18,7 +18,7 @@ random_number = num { deny[reason] { number := random_number - number < 5 + number < 1 reason := sprintf( "Unlucky you: got %d, but 5 or more is required", From 083d396e03a5a76334c5c7ac7204ac081e9677c8 Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub Date: Thu, 10 Nov 2022 18:38:19 +0200 Subject: [PATCH 08/23] test --- external_data/{random_decision4.rego => random_decision5.rego} | 0 external_data/scalr-policy.hcl | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename external_data/{random_decision4.rego => random_decision5.rego} (100%) diff --git a/external_data/random_decision4.rego b/external_data/random_decision5.rego similarity index 100% rename from external_data/random_decision4.rego rename to external_data/random_decision5.rego diff --git a/external_data/scalr-policy.hcl b/external_data/scalr-policy.hcl index 1b12799..153f197 100644 --- a/external_data/scalr-policy.hcl +++ b/external_data/scalr-policy.hcl @@ -20,7 +20,7 @@ policy "random_decision3" { enforcement_level = "advisory" } -policy "random_decision4" { +policy "random_decision5" { enabled = true enforcement_level = "advisory" } From 651f832107363e7b6a927f548566fd1b1112cfbc Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub Date: Thu, 10 Nov 2022 18:43:59 +0200 Subject: [PATCH 09/23] test --- .idea/inspectionProfiles/Project_Default.xml | 6 + .../inspectionProfiles/profiles_settings.xml | 6 + .idea/misc.xml | 4 + .idea/modules.xml | 8 + .idea/sample-tf-opa-policies.iml | 8 + .idea/vcs.xml | 6 + .idea/workspace.xml | 148 ++++++++++++++++++ ...m_decision5.rego => random_decision4.rego} | 0 external_data/scalr-policy.hcl | 2 +- 9 files changed, 187 insertions(+), 1 deletion(-) create mode 100644 .idea/inspectionProfiles/Project_Default.xml create mode 100644 .idea/inspectionProfiles/profiles_settings.xml create mode 100644 .idea/misc.xml create mode 100644 .idea/modules.xml create mode 100644 .idea/sample-tf-opa-policies.iml create mode 100644 .idea/vcs.xml create mode 100644 .idea/workspace.xml rename external_data/{random_decision5.rego => random_decision4.rego} (100%) diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml new file mode 100644 index 0000000..03d9549 --- /dev/null +++ b/.idea/inspectionProfiles/Project_Default.xml @@ -0,0 +1,6 @@ + + + + \ No newline at end of file diff --git a/.idea/inspectionProfiles/profiles_settings.xml b/.idea/inspectionProfiles/profiles_settings.xml new file mode 100644 index 0000000..105ce2d --- /dev/null +++ b/.idea/inspectionProfiles/profiles_settings.xml @@ -0,0 +1,6 @@ + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..d1e22ec --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..027a02f --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/sample-tf-opa-policies.iml b/.idea/sample-tf-opa-policies.iml new file mode 100644 index 0000000..d0876a7 --- /dev/null +++ b/.idea/sample-tf-opa-policies.iml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml new file mode 100644 index 0000000..f75812d --- /dev/null +++ b/.idea/workspace.xml @@ -0,0 +1,148 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 1662036309600 + + + 1665149600331 + + + 1665149678659 + + + 1666262708869 + + + 1666263614938 + + + 1668098299943 + + + + + + + + + + + + + \ No newline at end of file diff --git a/external_data/random_decision5.rego b/external_data/random_decision4.rego similarity index 100% rename from external_data/random_decision5.rego rename to external_data/random_decision4.rego diff --git a/external_data/scalr-policy.hcl b/external_data/scalr-policy.hcl index 153f197..1b12799 100644 --- a/external_data/scalr-policy.hcl +++ b/external_data/scalr-policy.hcl @@ -20,7 +20,7 @@ policy "random_decision3" { enforcement_level = "advisory" } -policy "random_decision5" { +policy "random_decision4" { enabled = true enforcement_level = "advisory" } From a481f1ea0bce03b966f88bac5d80f4442bc366dd Mon Sep 17 00:00:00 2001 From: Viacheslav Lyzohub Date: Tue, 15 Nov 2022 11:41:20 +0200 Subject: [PATCH 10/23] test --- .idea/workspace.xml | 36 ++++++++++--------- ...m_decision4.rego => random_decision5.rego} | 0 external_data/scalr-policy.hcl | 2 +- 3 files changed, 20 insertions(+), 18 deletions(-) rename external_data/{random_decision4.rego => random_decision5.rego} (100%) diff --git a/.idea/workspace.xml b/.idea/workspace.xml index f75812d..fd1cbbc 100644 --- a/.idea/workspace.xml +++ b/.idea/workspace.xml @@ -2,7 +2,7 @@ - + - { + "keyToString": { + "RunOnceActivity.OpenProjectViewOnStart": "true", + "RunOnceActivity.ShowReadmeOnStart": "true", + "TF_FMT": "false", + "WebServerToolWindowFactoryState": "true", + "last_opened_file_path": "/Users/lyzohub/Work/sample-tf-opa-policies/external_data", + "node.js.detected.package.eslint": "true", + "node.js.selected.package.eslint": "(autodetect)", + "nodejs_package_manager_path": "npm" } -}]]> +} @@ -46,14 +47,15 @@ - -