Einhaltung von Richtlinien mit OPA und Terraform: Ein praktischer Leitfaden

 1package terraform.module
 2
 3import input as tfplan
 4import rego.v1
 5
 6minimum_terraform := "1.6.0"
 7
 8deny contains msg if {
 9    v := tfplan.terraform_version
10    semver.compare(v, minimum_terraform) < 0
11
12    msg := sprintf("terraform version must be at least %v - %v is not supported", [minimum_terraform, v])
13}

1$ opa check policies/minimal_terraform_version.rego

 1resource "aws_s3_bucket" "example" {
 2  bucket = "my-tf-example-bucket"
 3}
 4
 5resource "aws_s3_bucket_ownership_controls" "example" {
 6  bucket = aws_s3_bucket.example.id
 7  rule {
 8    object_ownership = "BucketOwnerPreferred"
 9  }
10}
11
12resource "aws_s3_bucket_acl" "example" {
13  depends_on = [aws_s3_bucket_ownership_controls.example]
14
15  bucket = aws_s3_bucket.example.id
16  acl    = "public-read"
17}

1$ terraform plan -out tfplan

1$ terraform show -json tfplan > tfplan.json

 1$ opa eval --data policies/minimal_terraform_version.rego --input tfplan.json "data.terraform.module.deny"
 2
 3{
 4  "result": [
 5    {
 6      "expressions": [
 7        {
 8          "value": [],
 9          "text": "data.terraform.module.deny",
10          "location": {
11            "row": 1,
12            "col": 1
13          }
14        }
15      ]
16    }
17  ]
18}

 1package terraform.module
 2
 3import input as tfplan
 4import rego.v1
 5
 6allowed_s3_acls := ["private", "authenticated-read"]
 7
 8deny contains msg if {
 9    r := tfplan.resource_changes[_]
10    r.type == "aws_s3_bucket_acl"
11    not r.change.after.acl in allowed_s3_acls
12
13    msg := sprintf("%v - s3 buckets must have acls that are in %v", [r.address, allowed_s3_acls])
14}

 1$ opa eval --data policies/s3_bucket_acl.rego --input tfplan.json "data.terraform.module.deny"
 2
 3{
 4  "result": [
 5    {
 6      "expressions": [
 7        {
 8          "value": [
 9            "aws_s3_bucket_acl.example - s3 buckets must have acls that are in [\"private\", \"authenticated-read\"]"
10          ],
11          "text": "data.terraform.module.deny",
12          "location": {
13            "row": 1,
14            "col": 1
15          }
16        }
17      ]
18    }
19  ]
20}

 1package terraform.module
 2
 3import rego.v1
 4import input as tfplan
 5
 6disallowed_cidrs := ["0.0.0.0/0", "::/0"]
 7
 8deny contains msg if {
 9    r := tfplan.resource_changes[_]
10    r.type in ["aws_security_group_rule", "aws_security_group"]
11    valid_port(r.change.after.ingress[_])
12    invalid_cidr(r.change.after.ingress[_])
13
14    msg := sprintf("%v has 0.0.0.0/0 as allowed ingress for SSH / Port 22", [r.address])
15}
16
17valid_port(ingress) if ingress.from_port == 22
18valid_port(ingress) if ingress.to_port == 22
19
20invalid_cidr(ingress) if ingress.cidr_blocks[_] in disallowed_cidrs
21invalid_cidr(ingress) if ingress.ipv6_cidr_blocks[_] in disallowed_cidrs

 1resource "aws_security_group" "example" {
 2  name        = "example-sg"
 3  description = "Beispiel Sicherheitsgruppe"
 4
 5  ingress {
 6    from_port   = 22
 7    to_port     = 22
 8    protocol    = "tcp"
 9    cidr_blocks = ["0.0.0.0/0"]
10  }
11}
12
13resource "aws_security_group_rule" "example" {
14  type              = "ingress"
15  from_port         = 22
16  to_port           = 22
17  protocol          = "tcp"
18  ipv6_cidr_blocks = [ "::/0" ]
19  security_group_id = aws_security_group.example.id
20}

1$ terraform plan -out=tfplan
2$ terraform show -json tfplan > tfplan.json

 1$ opa eval --data policies/security_group_ssh.rego --input tfplan.json "data.terraform.module.deny"
 2
 3{
 4  "result": [
 5    {
 6      "expressions": [
 7        {
 8          "value": [
 9            "aws_security_group.example has 0.0.0.0/0 as allowed ingress for SSH / Port 22"
10          ],
11          "text": "data.terraform.module.deny",
12          "location": {
13            "row": 1,
14            "col": 1
15          }
16        }
17      ]
18    }
19  ]
20}

 1$ terraform plan -out=tfplan
 2$ terraform show -json tfplan > tfplan.json
 3$ opa exec --decision terraform/module/deny --bundle policies/ tfplan.json
 4{
 5  "result": [
 6    {
 7      "path": "tfplan.json",
 8      "result": [
 9        "aws_s3_bucket_acl.example - s3 buckets must have acls that are in [\"private\", \"authenticated-read\"]",
10        "aws_security_group.example has 0.0.0.0/0 as allowed ingress for SSH / Port 22"
11      ]
12    }
13  ]
14}