Skip to content

Commit 35a56a3

Browse files
timothyhinrichstsandall
timothyhinrichs
authored and
tsandall
committed
Add Terraform library
Small to start. Iterate from here.
1 parent e0c48ff commit 35a56a3

File tree

6 files changed

+518
-2
lines changed

6 files changed

+518
-2
lines changed

‎README.md

+23-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,23 @@
1-
# library
2-
A policy library for the Open Policy Agent
1+
# Library
2+
This repository is a community-owned policy library for the Open Policy Agent.
3+
The goal is to provide a place where the community can find and share logic for
4+
analyzing common JSON documents like Terraform plans and Kubernetes API objects.
5+
6+
The basic premise is to provide a library of Rego helper functions that
7+
other people can reuse and modify when writing their own policies
8+
along with example policies built using those functions, and
9+
tests that the example policies and helper functions operate as they should.
10+
OPA will be outfitted to pull in libraries and push/contribute helper functions
11+
to the library.
12+
13+
The basic format of each library is:
14+
15+
* Any number of .rego files within a directory constitute a library.
16+
* Files beginning with `example` are example policies demonstrating how to use the library.
17+
* Files beginning with `test` are tests either of the library or of the examples.
18+
* Files beginning with `input` are sample inputs used for tests or just as examples.
19+
20+
21+
22+
23+

‎terraform/example.rego

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
package terraform.example
2+
3+
import data.terraform.library
4+
5+
import input as tfplan
6+
7+
8+
########################
9+
# Parameters for Policy
10+
########################
11+
12+
# acceptable score for automated authorization
13+
blast_radius = 30
14+
15+
# weights assigned for each operation on each resource-type
16+
weights = {
17+
"aws_autoscaling_group": {"delete": 100, "create": 10, "modify": 1},
18+
"aws_instance": {"delete": 10, "create": 1, "modify": 1}
19+
}
20+
21+
#########
22+
# Policy
23+
#########
24+
25+
# Authorization holds if score for the plan is acceptable and no changes are made to IAM
26+
default authz = false
27+
authz {
28+
score < blast_radius
29+
not touches_iam
30+
}
31+
32+
# Compute the score for a Terraform plan as the weighted sum of deletions, creations, modifications
33+
score = s {
34+
all = [ x |
35+
weights[resource_type] = crud
36+
del = crud["delete"] * library.num_deletes_of_type[resource_type]
37+
new = crud["create"] * library.num_creates_of_type[resource_type]
38+
mod = crud["modify"] * library.num_modifies_of_type[resource_type]
39+
x1 = del + new
40+
x = x1 + mod
41+
]
42+
sum(all, s)
43+
}
44+
45+
# Whether there is any change to IAM
46+
touches_iam {
47+
all = library.instance_names_of_type["aws_iam"]
48+
count(all, c)
49+
c > 0
50+
}
51+

‎terraform/input.rego

+220
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
package terraform.inputs
2+
3+
4+
# Garden of eden. Create a few resources
5+
lineage0 = {
6+
"aws_autoscaling_group.lamb": {
7+
"arn": "",
8+
"availability_zones.#": "1",
9+
"availability_zones.3205754986": "us-west-1a",
10+
"default_cooldown": "",
11+
"desired_capacity": "4",
12+
"destroy": false,
13+
"destroy_tainted": false,
14+
"force_delete": "true",
15+
"health_check_grace_period": "300",
16+
"health_check_type": "ELB",
17+
"id": "",
18+
"launch_configuration": "kitten",
19+
"load_balancers.#": "",
20+
"max_size": "5",
21+
"metrics_granularity": "1Minute",
22+
"min_size": "1",
23+
"name": "lamb",
24+
"protect_from_scale_in": "false",
25+
"vpc_zone_identifier.#": "",
26+
"wait_for_capacity_timeout": "10m"
27+
},
28+
"aws_instance.puppy": {
29+
"ami": "ami-09b4b74c",
30+
"associate_public_ip_address": "",
31+
"availability_zone": "",
32+
"destroy": false,
33+
"destroy_tainted": false,
34+
"ebs_block_device.#": "",
35+
"ephemeral_block_device.#": "",
36+
"id": "",
37+
"instance_state": "",
38+
"instance_type": "t2.micro",
39+
"ipv6_addresses.#": "",
40+
"key_name": "",
41+
"network_interface_id": "",
42+
"placement_group": "",
43+
"private_dns": "",
44+
"private_ip": "",
45+
"public_dns": "",
46+
"public_ip": "",
47+
"root_block_device.#": "",
48+
"security_groups.#": "",
49+
"source_dest_check": "true",
50+
"subnet_id": "",
51+
"tenancy": "",
52+
"vpc_security_group_ids.#": ""
53+
},
54+
"aws_launch_configuration.kitten": {
55+
"associate_public_ip_address": "false",
56+
"destroy": false,
57+
"destroy_tainted": false,
58+
"ebs_block_device.#": "",
59+
"ebs_optimized": "",
60+
"enable_monitoring": "true",
61+
"id": "",
62+
"image_id": "ami-09b4b74c",
63+
"instance_type": "t2.micro",
64+
"key_name": "",
65+
"name": "kitten",
66+
"root_block_device.#": ""
67+
},
68+
"destroy": false
69+
}
70+
71+
# Create, modify, and delelete resources
72+
lineage1 = {
73+
"aws_autoscaling_group.lamb": {
74+
"destroy": false,
75+
"destroy_tainted": false,
76+
"max_size": "4"
77+
},
78+
"aws_instance.pony": {
79+
"ami": "ami-09b4b74c",
80+
"associate_public_ip_address": "",
81+
"availability_zone": "",
82+
"destroy": false,
83+
"destroy_tainted": false,
84+
"ebs_block_device.#": "",
85+
"ephemeral_block_device.#": "",
86+
"id": "",
87+
"instance_state": "",
88+
"instance_type": "t2.micro",
89+
"ipv6_addresses.#": "",
90+
"key_name": "",
91+
"network_interface_id": "",
92+
"placement_group": "",
93+
"private_dns": "",
94+
"private_ip": "",
95+
"public_dns": "",
96+
"public_ip": "",
97+
"root_block_device.#": "",
98+
"security_groups.#": "",
99+
"source_dest_check": "true",
100+
"subnet_id": "",
101+
"tenancy": "",
102+
"vpc_security_group_ids.#": ""
103+
},
104+
"aws_instance.puppy": {
105+
"destroy": true,
106+
"destroy_tainted": false
107+
},
108+
"destroy": false
109+
}
110+
111+
# Create several resources
112+
large_create = {
113+
"aws_autoscaling_group.my_asg": {
114+
"arn": "",
115+
"availability_zones.#": "1",
116+
"availability_zones.3205754986": "us-west-1a",
117+
"default_cooldown": "",
118+
"desired_capacity": "4",
119+
"destroy": false,
120+
"destroy_tainted": false,
121+
"force_delete": "true",
122+
"health_check_grace_period": "300",
123+
"health_check_type": "ELB",
124+
"id": "",
125+
"launch_configuration": "my_web_config",
126+
"load_balancers.#": "",
127+
"max_size": "5",
128+
"metrics_granularity": "1Minute",
129+
"min_size": "1",
130+
"name": "my_asg",
131+
"protect_from_scale_in": "false",
132+
"vpc_zone_identifier.#": "",
133+
"wait_for_capacity_timeout": "10m"
134+
},
135+
"aws_autoscaling_group.my_asg2": {
136+
"arn": "",
137+
"availability_zones.#": "1",
138+
"availability_zones.2487133097": "us-west-2a",
139+
"default_cooldown": "",
140+
"desired_capacity": "4",
141+
"destroy": false,
142+
"destroy_tainted": false,
143+
"force_delete": "true",
144+
"health_check_grace_period": "300",
145+
"health_check_type": "ELB",
146+
"id": "",
147+
"launch_configuration": "my_web_config",
148+
"load_balancers.#": "",
149+
"max_size": "6",
150+
"metrics_granularity": "1Minute",
151+
"min_size": "1",
152+
"name": "my_asg2",
153+
"protect_from_scale_in": "false",
154+
"vpc_zone_identifier.#": "",
155+
"wait_for_capacity_timeout": "10m"
156+
},
157+
"aws_autoscaling_group.my_asg3": {
158+
"arn": "",
159+
"availability_zones.#": "1",
160+
"availability_zones.221770259": "us-west-2b",
161+
"default_cooldown": "",
162+
"desired_capacity": "4",
163+
"destroy": false,
164+
"destroy_tainted": false,
165+
"force_delete": "true",
166+
"health_check_grace_period": "300",
167+
"health_check_type": "ELB",
168+
"id": "",
169+
"launch_configuration": "my_web_config",
170+
"load_balancers.#": "",
171+
"max_size": "7",
172+
"metrics_granularity": "1Minute",
173+
"min_size": "1",
174+
"name": "my_asg3",
175+
"protect_from_scale_in": "false",
176+
"vpc_zone_identifier.#": "",
177+
"wait_for_capacity_timeout": "10m"
178+
},
179+
"aws_instance.web": {
180+
"ami": "ami-09b4b74c",
181+
"associate_public_ip_address": "",
182+
"availability_zone": "",
183+
"destroy": false,
184+
"destroy_tainted": false,
185+
"ebs_block_device.#": "",
186+
"ephemeral_block_device.#": "",
187+
"id": "",
188+
"instance_state": "",
189+
"instance_type": "t2.micro",
190+
"ipv6_addresses.#": "",
191+
"key_name": "",
192+
"network_interface_id": "",
193+
"placement_group": "",
194+
"private_dns": "",
195+
"private_ip": "",
196+
"public_dns": "",
197+
"public_ip": "",
198+
"root_block_device.#": "",
199+
"security_groups.#": "",
200+
"source_dest_check": "true",
201+
"subnet_id": "",
202+
"tenancy": "",
203+
"vpc_security_group_ids.#": ""
204+
},
205+
"aws_launch_configuration.my_web_config": {
206+
"associate_public_ip_address": "false",
207+
"destroy": false,
208+
"destroy_tainted": false,
209+
"ebs_block_device.#": "",
210+
"ebs_optimized": "",
211+
"enable_monitoring": "true",
212+
"id": "",
213+
"image_id": "ami-09b4b74c",
214+
"instance_type": "t2.micro",
215+
"key_name": "",
216+
"name": "my_web_config",
217+
"root_block_device.#": ""
218+
},
219+
"destroy": false
220+
}

0 commit comments

Comments
 (0)