Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Terraform x OPA/Conftest の tips

Avatar for Ryo Kubota Ryo Kubota
July 07, 2021
Technology
1.2k
0

Terraform x OPA/Conftest の tips

OPA/Conftest で Terraform を扱う際の tips のまとめ

Avatar for Ryo Kubota

Ryo Kubota

July 07, 2021

More Decks by Ryo Kubota

See All by Ryo Kubota
TerraformのレビューをConftestで自動化する
Avatar for Ryo Kubota ryokbt
3
1.8k
Handling TV Ad Traffic Influx with Microservices
Avatar for Ryo Kubota ryokbt
0
1.6k

Other Decks in Technology

See All in Technology
KAEN Company Deck
Avatar for 株式会社KAEN kaen
PRO
0
320
Azure App Service / Container Apps の組み込み認証
Avatar for Kuniteru Asami kuniteru
0
200
Azure Cost Management の FOCUS コストデータを迷わず読むための“3つの軸”
Avatar for Tetsuya Odashima tetsuyaooooo
0
150
生成AIのテナント制御とシャドーMCP対策 | AIを"止めずに"、情報を守る
Avatar for yu yukun
0
120
コスト最適化の「めんどくさい」を AWS FinOps Agent でチョット楽にする
Avatar for kaz classmethod_kaz
0
250
Backstageでつくるセルフサービスな社内開発基盤
Avatar for Sakazaki Kikunosuke kikunosuke75
1
340
Oracle Cloud Infrastructure IaaS 新機能アップデート 2026/6 - 2026/8
Avatar for oracle4engineer oracle4engineer
PRO
0
100
設計の世代交代を乗り越える、14年続くAndroidアプリの開発戦略
Avatar for SansanTech sansantech
PRO
1
150
module Synths; end
Avatar for あそなす asonas
1
120
AI 駆動 Terraform 開発/SRE_BizReach_MIXI_2
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
2
1.7k
WAF 運用改善の承認サイクル/SRE_BizReach_MIXI_1
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
1
290
AI時代に、プロダクトの数だけ積み上がる所有コストをどうエンジニアリングするか / Engineering the Cost of Ownership
Avatar for Kazuki Maeda kzkmaeda
0
1k

Featured

See All Featured
Self-Hosted WebAssembly Runtime for Runtime-Neutral Checkpoint/Restore in Edge–Cloud Continuum
Avatar for Yuki Nakata chikuwait chikuwait
0
770
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
Avatar for Ines Montani inesmontani
PRO
3
2.4k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
515
110k
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
370
20k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
530
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k
Chasing Engaging Ingredients in Design
Avatar for Sebastian Deterding codingconduct
0
300
Performance Is Good for Brains [We Love Speed 2024]
Avatar for Tammy Everts tammyeverts
12
1.8k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
432
67k
How to make the Groovebox
Avatar for あそなす asonas
2
2.4k
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
1
1.6k

Transcript

  1. 5FSSBGPSNY01"$POGUFTUͷ UJQT Open Policy Agent Rego 
 Knowledge Sharing Meetup

    #2021.07 Ryo Kubota @ryok6t

  2. • Ryo Kubota (@ryok6t) • FiNC Technologies • SRE Team

    manager ࣗݾ঺հ

  3. લఏ • ϚΠΫϩαʔϏεΛ AWS EKS ্ʹσϓϩΠ • ֤αʔϏεͷΠϯϑϥ͸ҎԼͰίʔυ؅ཧ • Kubernetes

    ͷ manifest • Terraform • ֤։ൃνʔϜ͕ࣗ਎Ͱ͜ΕΒͷίʔυΛॻ͍͍ͯΔ • ࣭ͷ୲อͷͨΊʹ Conftest Λར༻

  4. Ҏલͷൃද • https://speakerdeck.com/ryokbt/terraformfalserebiyuwoconftestdezi-dong-hua-suru

  5. ຊ೔ͷ಺༰ • ʢಛʹʣTerraform Ͱ OPA Λ࢖͏৔߹ͷͪΐͬͱͨ͠ίπ • ࣗ෼͕ OPA Λಋೖ͢Δલʹ஌Γ͔ͨͬͨ͜ͱͷ·ͱΊ

  6. ·ͣ͸QMBOΛ+40/ʹ • plan ݁ՌΛ JSON ʹ͢Δͱ͜Ζ͔Β • terraform plan -out

    plan.tfplan • terraform show -json plan.tfplan | conftest test -

  7. 5FSSBGPSNQMBOͷ+40/ ϦιʔεͱͦΕʹର͢ΔมߋҰཡ Ճ͑Δૢ࡞ʢDSFBUF VQEBUFͳͲʣ Ϧιʔεͷ৘ใ มߋલมߋޙͷঢ়ଶ

  8. ϙϦγʔΛॻ͘ WJPMBUJPOEFOZXBSOͷQSFpYΛ͚ͭΔ • ʮresource type ͕ security group Ͱɺport ͕


    ϑϧΦʔϓϯͳ΋ͷ͕1ݸͰ΋͋Ε͹ violationʯ

  9. ڞ௨ͷॲཧΛ·ͱΊΔ • ڞ௨ͷॲཧΛ͢Δέʔε͕ଟ͍ • e.g. ಛఆͷ resource type ͷ࣌ͷΈద༻͢Δ •

    ઌͷྫͩͱɺsecurity group ͷ͚࣌ͩద༻͢ΔͳͲ • ຖճॻ͘ͷ͸໘౗

  10. GVODUJPOΛ࢖ͬͨڞ௨ॲཧ ड͚औͬͨUZQFʹ
 ౰ͯ͸·Δ΋ͷ͚ͩΛฦ͢

  11. ڞ௨ॲཧΛผͷϑΝΠϧʹ੾Γग़͢ • ڞ௨ॲཧ༻ͷ package Λ࡞͓ͬͯ͘

  12. ڞ௨ॲཧΛผϑΝΠϧ͔Βݺͼग़͢ ڞ௨ॲཧ༻ͷQBDLBHFΛJNQPSU CBTFSFTPVSDFTͰݺͼग़ͤΔΑ͏ʹ

  13. ྫ֎έʔεΛѻ͏ • There is no rule without exceptions • ಛఆͷϦιʔε͚ͩϧʔϧͷର৅֎ʹ͍ͨ͠έʔε͕ଘࡏ

  14. lFYDFQUJPOzΛ࢖ͬͯྫ֎ʹରԠ • ྫ֎ͷϩδοΫʹ౰ͯ͸·ͬͨ৔߹ɺrules Ͱࢦఆͨ͠΋ ͷ͸ແࢹ͞ΕΔ • ҎԼͰ͸ “deny_foo”, “violation_foo” ͳͲ͕ແࢹ͞ΕΔ

  15. ςετΛॻ͘ • Rego ͷจ๏ʹ͸Ϋη͕͋ΔͨΊɺςετ͕ॏཁ • Conftest ࣗମͰ؆୯ʹςετ͕Մೳ

  16. ςετͷํ๏ • foo.rego ʹରͯ͠ɺfoo_test.rego ͱ͍͏ϑΝΠϧΛ༻ҙ • conftest verify Λ࣮ߦ

  17. ςετͷྫʢWJPMBUJPOʹͳΔέʔεʣ ϑϧΦʔϓϯʹͳ͍ͬͯΔͷͰ
 WJPMBUJPOʹͳΔ͜ͱΛςετ

  18. ςετίʔυͷߏ଄ QMBOͷ+40/ͱಉ͡ߏ଄Ͱ ςετσʔλΛੜ੒ XJUIBTΛ࢖ͬͯ
 ςετσʔλΛ༩͑Δ

  19. ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε

  20. ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε • not Λ͚ͭΔ͚ͩ

  21. ςετσʔλʹ͍ͭͯ • ެࣜυΩϡϝϯτͰ͸ɺςετίʔυʹ JSON Λ௚઀
 ॻ͍͍ͯΔ • Ҿ༻: https://www.openpolicyagent.org/docs/latest/policy-testing/

  22. ςετσʔλʹ͍ͭͯ • ͔͠͠ JSON Λ௚઀ॻ͘ͱਏ͍έʔε͕ଟ͍ • ݱࡏ͸ yaml Ͱॻ͍ͯ yaml.unmarshal

    ͍ͯ͠Δ

  23. ࠷ޙʹσόοάʹ͍ͭͯ • policy ΍ͦͷςετΛॻ͍͍ͯΔͱσόοά͕ͨ͘͠ͳΔ • ೚ҙͷՕॴʹ trace(string) Λ࢓ࠐΉ͜ͱͰσόοάग़ྗ ͕Մೳ •

    `—trace` Φϓγϣϯ෇͖Ͱ Conftest Λ࣮ߦ