This adds dynamic routing / policy compositon based on the input.resource.type, mapping something like AWS::S3::Bucket to the data.aws.s3.bucket package, where the deny rule(s) will be evaluated, and the result aggregated into the decision. Moved and remodeled the policies and tests to work with this.
Since it's been a while since I worked a full day on policy authoring, here are some random thoughts and findings from this experience:
Metadata annotations are really nice! Thanks @johanfylling :)
However, opa inspect -a wasn't intuitive to me for this purpose. It still seems to want a bundle file, although I'm only interested in inspecting annotations in my rego files.
With policies mapped to a single resource type, being able to use JSON schema for input validation would be killer. But once again we're burnt by the "booleans are strings" fiasco.
Random idea around annotations - it would be nice to be able to reference the package name from inside an inherited annotation, particularly when using schemas, i.e, something like:
That way we could apply schemas to all subpackages with a single declaration 🤯 🚀
opa fmt is pretty annoying, in particular for test files where we construct lots of maps manually. These don't take line length into account, and sometimes makes a well structured map compressed into a single 300 chars long line 🤦
Created some test helpers for getting to know what failed in tests (by simply printing expectation vs reality), and those are definitely a keeper until we have that in OPA proper!
This adds dynamic routing / policy compositon based on the input.resource.type, mapping something like
AWS::S3::Bucket
to thedata.aws.s3.bucket
package, where the deny rule(s) will be evaluated, and the result aggregated into the decision. Moved and remodeled the policies and tests to work with this.Since it's been a while since I worked a full day on policy authoring, here are some random thoughts and findings from this experience:
opa inspect -a
wasn't intuitive to me for this purpose. It still seems to want a bundle file, although I'm only interested in inspecting annotations in my rego files.That way we could apply schemas to all subpackages with a single declaration 🤯 🚀
opa fmt
is pretty annoying, in particular for test files where we construct lots of maps manually. These don't take line length into account, and sometimes makes a well structured map compressed into a single 300 chars long line 🤦opa fmt
, also got burnt by https://github.com/open-policy-agent/opa/issues/4376