CODEWITHSUNDEEP
terraformpasswordsopa
Biju
Biju

Reputation: 1008

How to detect illegal password handling in Terraform code using Open Policy Agent (OPA)?

I am creating RDS using Terraform by using a code that looks something like this:

data "aws_secretsmanager_secret_version" "creds" {
  # Fill in the name you gave to your secret
  secret_id = "db-creds"
}

locals {
  db_creds = jsondecode(
    data.aws_secretsmanager_secret_version.creds.secret_string
  )
}

resource "aws_db_instance" "example" {
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t2.micro"
  name                 = "example"
  # Set the secrets from AWS Secrets Manager
  username = local.db_creds.username
  password = local.db_creds.password
}

Using rego in OPA how can I raise an error if password is NOT passed from secrets manager as shown above (and passed through illegal ways like hardcoded password instead)?

Terraform plan output just shows the password irrespective of whether it was obtained through a hardcoded value or through secrets manager - hence my confusion.

Upvotes: 0

Views: 179

Answers (1)

Devoops
Devoops

Reputation: 2360

OPA normally works on the level of the plan file, so that would not be possible. The OPA-based conftest project allows you to write policies on HCL converted to JSON, so that might be an option, depending on your circumstances.

Upvotes: 0

Related Questions