terraform-compliance / cli

a lightweight, security focused, BDD test framework against terraform.
https://terraform-compliance.com
MIT License
1.34k stars 151 forks source link

Is `or` logic supported at all? #722

Closed Yakuza-UA closed 8 months ago

Yakuza-UA commented 9 months ago

Question:

Hi guys!

We've only just started exploring the world of terraform-compliance and BDD logic. I am trying to build a single scenario policy which will check if people deploy into one of the approved regions. I tried different ways but the only working one seems to be via regex's or pipe. Although it works it doesn't feel right/optimal. E.g. if I have to check against multiple values my regex may become cumbersome and not very easy to read (immediately I am thinking of tags - where we only accept certain values).

This is what I tried:

Feature: Ensure Azure resources are deployed in the supported regions

Scenario: Azure Region is Japan East, Australia East, or West Europe
  Given I have any resource defined
  When it has location
  Then it must contain location
  And its value must match the "^(japaneast|australiaeast|westeurope)$" regex

As I said, this works, but if I have to support like 10 regions, this becomes not easy to read/understand. I've then tried another approach:

Feature: Ensure Azure resources are deployed in the supported regions

Scenario: Azure Region is Japan East, Australia East, or West Europe
  Given I have any resource defined
  When its location is not japaneast
  And when its location is not australiaeast
  And when its location is not westeurope
  Then it fails

This works too, but it SKIPS compliant resources, rather than PASSES the check. This impacts the report as number of skipped checks is misleading. So... is regex the only way to support the desired behavior, or am I missing something in BDD logic that can help me achieve the desired behavior?

Many thanks for any help in advance

Yakuza-UA commented 8 months ago

Reading more about BDD I understand this is not supported (an OR logic) and must be achieved by other means - multiple scenarios, or scenario outlines. I am closing this issue.