OPA Series Part 4: Simple Policies for Scalr

Author
Peter Gale Dec 18, 2020 • 10 Min Read
Share:

Open Policy Agent (OPA) is a declarative policy language that can be used across your cloud ecosystem to ensure controlled deployments. It has increased in popularity with the Terraform community as a way to check Terraform plans and ensure DevOps teams are deploying according to organizational standards.

The first 3 parts in this series provided an overview of developing and testing OPA policies and a detailed guide to writing OPA policies for Terraform and Scalr.

In this article we are providing a series of simple templates that implement a number of common policy requirements. The templates are easily adaptable for resource and attribute, and each template is set to work for top level attributes of a resource.

Common Policy Requirements

This initial set of templates covers the following.

Rego Description
actions-blacklist.rego Black list for Actions, Create, Update Delete
array-blacklist.rego Black list for values of an array type attribute
array-whitelist.rego White list for values of an array type attribute
attribute_check.rego Check that an attribute has been specified and with a non-null value
attribute_value_regex.rego Check attribute value matches a regular expression
numeric-range.rego Check an attribute numeric value is within range (>=min, <=max or both)
resource-type-blacklist.rego Black list of resource types
resource-type-whitelist.rego White list of resource types
scalar-blacklist.rego Black list for values of a scalar type attribute
scalar-whitelist.rego White list for values of a scalar type attribute

In general these templates can be configured simply by setting the resources, attribute and ...list variables as in this example:

  resource := "{resource_name}"

# The planned value for this scalr attribute
attribute := "{attribute_name}"

# Is checked against this blacklist. If the value IS present in the list the policy is violated.
# This can be a single value list, and can be numerics, booleans or strings
black_list := [
"{value}",
"{value}",
]
  

The templates can all be pulled from this github repo (https://github.com/scalr-eap/policy-templates). Below are a few examples with expanded descriptions of the OPA logic.

Generic Policy Templates

These templates make use of the capability to reference an attribute via a variable as shown in this code snippet

  attribute = "key_name"
r = tfplan.resource_changes[_]
item = r.change.after[attribute]
  

The variable “item” would now contain the value of the “key_name” attribute, or would be undefined if the attribute does not exist.

scalr-blacklist.rego

This policy implements a black list for values of a scalar type attribute.

  # Implements a blacklist on a scalar attribute

package terraform

import input.tfplan as tfplan

resource := "{resource_name}"

# The planned value for this scalr attribute
attribute := "{attribute_name}"

# Is checked against this blacklist. If the value IS present in the list the policy is violated.
# This can be a single value list, and can be numerics, booleans or strings
black_list := [
"{value}",
"{value}",
]

# Check if value is in black list for the attribute
deny[reason] {
r = tfplan.resource_changes[_]
r.mode == "managed"
r.type == resource
black_list[_] == r.change.after[attribute]

reason := sprintf("%-40s :: %s value '%s' is not allowed", [r.address, attribute, r.change.after[attribute]])
}
  

The critical rule here is Line 24

  black_list[_] == r.change.after[attribute]

This iterates on all the values in the black_list and if a match with the attribute value is found then the reason is assigned in the next rule.

array-whitelist.rego

This policy implements a white list for values of an array type attribute.

  # Implements a whitelist on a array attribute

package terraform

import input.tfplan as tfplan

resource := "{resource_name}"

# The planned value for this array attribute
attribute := "{attribute_name}"

# Is checked against this whitelist.
# If any of the values ARE NOT present in the list the policy is violated.
# This can be a single value list, and can be numerics, booleans or strings
white_list := [
"{value}",
"{value}",
]

array_contains(arr, elem) {
arr[_] = elem
}

# Check if value is in white list for the attribute
deny[reason] {
r = tfplan.resource_changes[_]
r.mode == "managed"
r.type == resource
list_item = r.change.after[attribute][_]
not array_contains(white_list, list_item)

reason := sprintf("%-40s :: %s value '%s' is not allowed", [r.address, attribute, list_item])
}
  

This policy differs from the first one in two respects. Firstly it’s a white list, so we need to check for matches to any values, and secondly the attribute is an array, so we need iterate on that array as well as the white list

The critical lines are 29-30

  list_item = r.change.after[attribute][_]
not array_contains(white_list, list_item)
  

The resource attribute is also an array, so we need to start an iteration on that as well. We can use the same variable to reference the attribute and simply suffix the expression with “[_]” to start the iteration.

Because it’s a white list we can't do a simple iteration on the array. The attribute value will only match zero or one item in the array, and all the non matching values would drop through and set the reason. So to make this work we need a helper rule (array_contains) that will return true if there is any match to the array. We only want to set the reason if there is no match, so we negate the function call with a “not”

Summary

The examples above and other templates can be pulled from this github repo (https://github.com/scalr-eap/policy-templates).

If you have not read parts one, two or three yet, please check them out. If you are interested in more examples, Scalr maintains an ever expanding library of OPA policy examples in our Github repository. Feel free to make a PR and contribute or create an issue if there is an example you would like to see.

Resources:

Ready to get started?

Scalr is free for up to 5 users