We've only just started exploring the world of terraform-compliance and BDD logic. I am trying to build a single scenario policy which will check if people deploy into one of the approved regions. I tried different ways but the only working one seems to be via regex's or pipe. Although it works it doesn't feel right/optimal. E.g. if I have to check against multiple values my regex may become cumbersome and not very easy to read (immediately I am thinking of tags - where we only accept certain values).
This is what I tried:
Feature: Ensure Azure resources are deployed in the supported regions
Scenario: Azure Region is Japan East, Australia East, or West Europe
Given I have any resource defined
When it has location
Then it must contain location
And its value must match the "^(japaneast|australiaeast|westeurope)$" regex
As I said, this works, but if I have to support like 10 regions, this becomes not easy to read/understand. I've then tried another approach:
Feature: Ensure Azure resources are deployed in the supported regions
Scenario: Azure Region is Japan East, Australia East, or West Europe
Given I have any resource defined
When its location is not japaneast
And when its location is not australiaeast
And when its location is not westeurope
Then it fails
This works too, but it SKIPS compliant resources, rather than PASSES the check. This impacts the report as number of skipped checks is misleading. So... is regex the only way to support the desired behavior, or am I missing something in BDD logic that can help me achieve the desired behavior?
Reading more about BDD I understand this is not supported (an OR logic) and must be achieved by other means - multiple scenarios, or scenario outlines. I am closing this issue.
Question:
Hi guys!
We've only just started exploring the world of terraform-compliance and BDD logic. I am trying to build a single scenario policy which will check if people deploy into one of the approved regions. I tried different ways but the only working one seems to be via regex's
or
pipe. Although it works it doesn't feel right/optimal. E.g. if I have to check against multiple values my regex may become cumbersome and not very easy to read (immediately I am thinking of tags - where we only accept certain values).This is what I tried:
As I said, this works, but if I have to support like 10 regions, this becomes not easy to read/understand. I've then tried another approach:
This works too, but it SKIPS compliant resources, rather than PASSES the check. This impacts the report as number of skipped checks is misleading. So... is regex the only way to support the desired behavior, or am I missing something in BDD logic that can help me achieve the desired behavior?
Many thanks for any help in advance