search

StyraInc / opa-aws-cloudformation-hook

AWS Cloudformation Hook for OPA-powered infrastructure policy enforcement
Apache License 2.0
35 stars 5 forks source link

Use wildcard targets #43

Closed anderseknert closed 1 year ago

anderseknert commented 1 year ago

This wasn't possible before, but now it is: https://aws.amazon.com/about-aws/whats-new/2022/12/target-multiple-resources-wildcard-configuration-aws-cloudformation-hooks/

Signed-off-by: Anders Eknert anders@eknert.com

PatMyron commented 1 year ago

Why not just one "*" instead of listing every "AWS::SERVICE::*"? Then you don't need to continue running this cronjob and re-registering hooks: https://github.com/iann0036/cfn-hooks/pull/5

pauly4it commented 1 year ago

@PatMyron great question. The CloudFormation Hook docs aren't clear on the full scope of the wildcard support. The docs state that the wildcard functionality supports AWS::Service::* and supports AWS::*::Resource*, but they don't state if AWS::*::* is supported. That's something we'll need to test. In the meantime, the change in this PR significantly simplifies the hook configuration.

Edit: Also unclear based on the docs if *::*::* would be supported to also cover services/resources like Alexa::ASK::*.

anderseknert commented 1 year ago

@PatMyron a single wildcard is enough to cover all resources? That'd be great if so!

PatMyron commented 1 year ago

Shouldn't need more than one targetName to cover all resource types

anderseknert commented 1 year ago

That certainly wasn't made clear in the docs. Did you try it and find it working?