CODEWITHSUNDEEP
open-policy-agentrego
Amadeaus
Amadeaus

Reputation: 63

Rego Object matching and comparison

I'm trying to match the domain key ("domain":"example.com") from the given input, and return an error if the values are not identical. This is what I've thought of so far, but I can't seem to match the domain key, thus the tests are failing. Any advice would be appreciated.

OPA Policy:

package main
import data.config

default warning_mode = []
warning_mode = config.warn_mode { config.warn_mode }

array_contains(arr, elem) {
  arr[_] = elem
}

exception[rules] {
    rules := config.exceptions.rules
}

deny_missing_config[msg] {
    not config
    msg := "Missing configuration file"
}

## Main

aws_ses_dkim[a] {
  a := input.resource_changes[_]
  a.type == "aws_ses_domain_dkim"
}

aws_ses_domain[e] {
  e := input.resource_changes[_]
  e.type == "aws_ses_domain_identity"
}

ses_missing_dkim[msg] {
    a := aws_ses_dkim[_]
    e := aws_ses_domain[_]
    walk(a, [["values", "domain"], x])
    walk(e, [["values", "domain"], y])
    err := x - y

    not err == set()
    msg := sprintf("Placeholder error", [err, a.address, e.address])
}


## Test Cases

deny_ses_missing_dkim[msg]{
  not array_contains(warning_mode, "ses_missing_dkim")
  ses_missing_dkim[_] != []
  msg := ses_missing_dkim[_]
}

warn_ses_missing_dkim[msg]{
  array_contains(warning_mode, "ses_missing_dkim")
  ses_missing_dkim[_] != []
  msg := ses_missing_dkim[_]
}

test_ses_missing_dkim_invalid {
    i := data.mock.invalid_ses_dkim
    r1 := warn_ses_missing_dkim with input as i with data.config.warn_mode as []
    count(r1) == 0
    r2 := warn_ses_missing_dkim with input as i with data.config.warn_mode as ["ses_missing_dkim"]
    count(r2) == 1
    r3 := deny_ses_missing_dkim with input as i with data.config.warn_mode as []
    count(r3) == 1
    r4 := deny_ses_missing_dkim with input as i with data.config.warn_mode as ["ses_missing_dkim"]
    count(r4) == 0
    count(r1) + count(r2) == 1
    count(r3) + count(r4) == 1
}

test_ses_missing_dkim_valid {
    i := data.mock.ses_dkim
    r1 := warn_ses_missing_dkim with input as i with data.config.warn_mode as []
    r2 := warn_ses_missing_dkim with input as i with data.config.warn_mode as ["ses_missing_dkim"]
    r3 := deny_ses_missing_dkim with input as i with data.config.warn_mode as []
    r4 := deny_ses_missing_dkim with input as i with data.config.warn_mode as ["ses_missing_dkim"]
    count(r1) + count(r2) + count(r3) + count(r4) == 0
}

Input (Terraform JSON):

                "resource_changes":[
                   {
                      "address":"aws_ses_domain_dkim.example",
                      "mode":"managed",
                      "type":"aws_ses_domain_dkim",
                      "name":"example",
                      "provider_name":"registry.terraform.io/hashicorp/aws",
                      "schema_version":0,
                      "values":{
                         "domain":"example.com"
                      },
                      "sensitive_values":{
                         "dkim_tokens":[
                            
                         ]
                      }
                   },
                   {
                      "address":"aws_ses_domain_identity.example",
                      "mode":"managed",
                      "type":"aws_ses_domain_identity",
                      "name":"example",
                      "provider_name":"registry.terraform.io/hashicorp/aws",
                      "schema_version":0,
                      "values":{
                         "domain":"example.com"
                      },
                      "sensitive_values":{
                         
                      }
                   }
                ]

Upvotes: 0

Views: 1046

Answers (1)

Devoops
Devoops

Reputation: 2315

The x and y values retrieved by the walk function will be strings, so err := x - s isn't going to work. If you want a set of values, you could wrap the walk call in a set comprehension to get a set of all values:

ses_missing_dkim[msg] {
    a := aws_ses_dkim[_]
    e := aws_ses_domain[_]
    xs := {x | walk(a, [["values", "domain"], x])}
    ys := {y | walk(e, [["values", "domain"], y])}
    
    err := xs - ys

    not err == set()
    
    msg := sprintf("Placeholder error", [err, a.address, e.address])
}

You probably don't need walk here though, as the values are always at a known path.

Upvotes: 1

Related Questions