Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Terraform x OPA/Conftest の tips
Search
Ryo Kubota
July 07, 2021
Technology
0
1.1k
Terraform x OPA/Conftest の tips
OPA/Conftest で Terraform を扱う際の tips のまとめ
Ryo Kubota
July 07, 2021
Tweet
Share
More Decks by Ryo Kubota
See All by Ryo Kubota
TerraformのレビューをConftestで自動化する
ryokbt
3
1.7k
Handling TV Ad Traffic Influx with Microservices
ryokbt
0
1.5k
Other Decks in Technology
See All in Technology
多野優介
tanoyusuke
1
420
VCC 2025 Write-up
bata_24
0
180
Oracle Base Database Service 技術詳細
oracle4engineer
PRO
11
77k
20201008_ファインディ_品質意識を育てる役目は人かAIか___2_.pdf
findy_eventslides
0
120
リーダーになったら未来を語れるようになろう/Speak the Future
sanogemaru
0
280
GC25 Recap+: Advancing Go Garbage Collection with Green Tea
logica0419
1
400
組織観点からIAM Identity CenterとIAMの設計を考える
nrinetcom
PRO
1
170
定期的な価値提供だけじゃない、スクラムが導くチームの共創化 / 20251004 Naoki Takahashi
shift_evolve
PRO
3
300
10年の共創が示す、これからの開発者と企業の関係 ~ Crossroad
soracom
PRO
1
170
データエンジニアがこの先生きのこるには...?
10xinc
0
440
許しとアジャイル
jnuank
1
120
実装で解き明かす並行処理の歴史
zozotech
PRO
1
320
Featured
See All Featured
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
32
1.6k
Automating Front-end Workflow
addyosmani
1371
200k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
51k
The Language of Interfaces
destraynor
162
25k
Large-scale JavaScript Application Architecture
addyosmani
514
110k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
33
2.5k
The Art of Programming - Codeland 2020
erikaheidi
56
14k
Build your cross-platform service in a week with App Engine
jlugia
232
18k
The Invisible Side of Design
smashingmag
301
51k
Rebuilding a faster, lazier Slack
samanthasiow
84
9.2k
Documentation Writing (for coders)
carmenintech
75
5k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
234
17k
Transcript
5FSSBGPSNY01"$POGUFTUͷ UJQT Open Policy Agent Rego Knowledge Sharing Meetup
#2021.07 Ryo Kubota @ryok6t
• Ryo Kubota (@ryok6t) • FiNC Technologies • SRE Team
manager ࣗݾհ
લఏ • ϚΠΫϩαʔϏεΛ AWS EKS ্ʹσϓϩΠ • ֤αʔϏεͷΠϯϑϥҎԼͰίʔυཧ • Kubernetes
ͷ manifest • Terraform • ֤։ൃνʔϜ͕ࣗͰ͜ΕΒͷίʔυΛॻ͍͍ͯΔ • ࣭ͷ୲อͷͨΊʹ Conftest Λར༻
Ҏલͷൃද • https://speakerdeck.com/ryokbt/terraformfalserebiyuwoconftestdezi-dong-hua-suru
ຊͷ༰ • ʢಛʹʣTerraform Ͱ OPA Λ͏߹ͷͪΐͬͱͨ͠ίπ • ͕ࣗ OPA Λಋೖ͢ΔલʹΓ͔ͨͬͨ͜ͱͷ·ͱΊ
·ͣQMBOΛ+40/ʹ • plan ݁ՌΛ JSON ʹ͢Δͱ͜Ζ͔Β • terraform plan -out
plan.tfplan • terraform show -json plan.tfplan | conftest test -
5FSSBGPSNQMBOͷ+40/ ϦιʔεͱͦΕʹର͢ΔมߋҰཡ Ճ͑Δૢ࡞ʢDSFBUF VQEBUFͳͲʣ Ϧιʔεͷใ มߋલมߋޙͷঢ়ଶ
ϙϦγʔΛॻ͘ WJPMBUJPOEFOZXBSOͷQSFpYΛ͚ͭΔ • ʮresource type ͕ security group Ͱɺport ͕
ϑϧΦʔϓϯͳͷ͕1ݸͰ͋Ε violationʯ
ڞ௨ͷॲཧΛ·ͱΊΔ • ڞ௨ͷॲཧΛ͢Δέʔε͕ଟ͍ • e.g. ಛఆͷ resource type ͷ࣌ͷΈద༻͢Δ •
ઌͷྫͩͱɺsecurity group ͷ͚࣌ͩద༻͢ΔͳͲ • ຖճॻ͘ͷ໘
GVODUJPOΛͬͨڞ௨ॲཧ ड͚औͬͨUZQFʹ ͯ·Δͷ͚ͩΛฦ͢
ڞ௨ॲཧΛผͷϑΝΠϧʹΓग़͢ • ڞ௨ॲཧ༻ͷ package Λ࡞͓ͬͯ͘
ڞ௨ॲཧΛผϑΝΠϧ͔Βݺͼग़͢ ڞ௨ॲཧ༻ͷQBDLBHFΛJNQPSU CBTFSFTPVSDFTͰݺͼग़ͤΔΑ͏ʹ
ྫ֎έʔεΛѻ͏ • There is no rule without exceptions • ಛఆͷϦιʔε͚ͩϧʔϧͷର֎ʹ͍ͨ͠έʔε͕ଘࡏ
lFYDFQUJPOzΛͬͯྫ֎ʹରԠ • ྫ֎ͷϩδοΫʹͯ·ͬͨ߹ɺrules Ͱࢦఆͨ͠ ͷແࢹ͞ΕΔ • ҎԼͰ “deny_foo”, “violation_foo” ͳͲ͕ແࢹ͞ΕΔ
ςετΛॻ͘ • Rego ͷจ๏ʹΫη͕͋ΔͨΊɺςετ͕ॏཁ • Conftest ࣗମͰ؆୯ʹςετ͕Մೳ
ςετͷํ๏ • foo.rego ʹରͯ͠ɺfoo_test.rego ͱ͍͏ϑΝΠϧΛ༻ҙ • conftest verify Λ࣮ߦ
ςετͷྫʢWJPMBUJPOʹͳΔέʔεʣ ϑϧΦʔϓϯʹͳ͍ͬͯΔͷͰ WJPMBUJPOʹͳΔ͜ͱΛςετ
ςετίʔυͷߏ QMBOͷ+40/ͱಉ͡ߏͰ ςετσʔλΛੜ XJUIBTΛͬͯ ςετσʔλΛ༩͑Δ
ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε
ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε • not Λ͚ͭΔ͚ͩ
ςετσʔλʹ͍ͭͯ • ެࣜυΩϡϝϯτͰɺςετίʔυʹ JSON Λ ॻ͍͍ͯΔ • Ҿ༻: https://www.openpolicyagent.org/docs/latest/policy-testing/
ςετσʔλʹ͍ͭͯ • ͔͠͠ JSON Λॻ͘ͱਏ͍έʔε͕ଟ͍ • ݱࡏ yaml Ͱॻ͍ͯ yaml.unmarshal
͍ͯ͠Δ
࠷ޙʹσόοάʹ͍ͭͯ • policy ͦͷςετΛॻ͍͍ͯΔͱσόοά͕ͨ͘͠ͳΔ • ҙͷՕॴʹ trace(string) ΛࠐΉ͜ͱͰσόοάग़ྗ ͕Մೳ •
`—trace` Φϓγϣϯ͖Ͱ Conftest Λ࣮ߦ