Skip to content
This repository has been archived by the owner on Sep 3, 2024. It is now read-only.

[BUG] How to create Regula rules based on resource_changes selection under terraform plan json file #382

Open
harsh-paypay opened this issue Dec 23, 2022 · 0 comments

Comments

@harsh-paypay
Copy link

harsh-paypay commented Dec 23, 2022

Describe the bug
For some resources, planned values are updated under resource_changes of the TF plan job. For example, for the vpc_flow_log enable rule, most of the details are present under resource_changes instead of resources.
I tried the below code but didn't work.
resource_changes = fugue.plan.resource_changes

How you're running Regula
Please include versions of all relevant tools. Some examples:

  • I'm using Regula v2.10.0 as a Rego library with OPA v0.47.1 and a Terraform plan JSON input that I generated with Terraform v1.3.6
  • I'm using Regula v#.#.# as a CLI tool and my Terraform source code as an input:
regula run my-modules-dir

Operating System
This can be relevant in some situations. - MacOS 12

Steps to reproduce

vpcs = fugue.plan.resource_changes("aws_vpc")
flow_logs = fugue.plan.resource_changes("aws_flow_log")
flow_log_vpc_ids = {vpc_id | vpc_id = flow_logs[_].vpc_id}
resource_type := "MULTIPLE"

policy[j] {
  vpc = vpcs[_]
  flow_log_vpc_ids[vpc.id]
  j = fugue.allow_resource(vpc)
} {
  vpc = vpcs[_]
  not flow_log_vpc_ids[vpc.id]
  j = fugue.deny_resource(vpc)
}

IaC Configuration
NA

Additional context
NA

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant