Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Terraform x OPA/Conftest の tips

6c366ab6293eb42aec0e6f5f69b50882?s=47 Ryo Kubota
July 07, 2021
Technology
0
500

Terraform x OPA/Conftest の tips

OPA/Conftest で Terraform を扱う際の tips のまとめ

6c366ab6293eb42aec0e6f5f69b50882?s=128

Ryo Kubota

July 07, 2021
Tweet

More Decks by Ryo Kubota

See All by Ryo Kubota
TerraformのレビューをConftestで自動化する
6c366ab6293eb42aec0e6f5f69b50882?s=48 ryokbt
3
770
Handling TV Ad Traffic Influx with Microservices
6c366ab6293eb42aec0e6f5f69b50882?s=48 ryokbt
0
1.3k

Other Decks in Technology

See All in Technology
ReverseETLでユーザーに価値を届ける基盤を実現した話
0c847ea07895706f7435ef67d31a5f6e?s=48 hakky
0
330
Oracle Cloud Infrastructure：2022年7月度サービス・アップデート
3115a782126be714b5f94d24073c957d?s=48 oracle4engineer
PRO
0
150
ここが好きだよAWS管理ポリシー_devio2022/i_am_iam_lover
325ce6fcd0a74ff78990b8632817da55?s=48 yukihirochiba
0
3k
eBPF-based Container Networking
98b5759510e487ade4145247bc856366?s=48 johnlin
2
1.1k
データ分析のためのAWS Well-Architected -Data Analytics Lens-
Eefeb193691fd905cf9edafc98f7198d?s=48 maru1981
0
220
SPAとWebアプリケーションでCognitoの使い方はどう変わるのか？ / How do we use cognito with SPA and web applications?
7d75345644fa75da12a5e5215ac2352a?s=48 kitano_yuichi
0
350
Trusted Web プロトタイプ
525442fc70ca92f82ae503f826956137?s=48 finengine
0
310
フィンテック養成勉強会#24
525442fc70ca92f82ae503f826956137?s=48 finengine
0
320
Learning to Solve Hard Minimal Problems
2c88806cbaab6024dc95b9a654c99d86?s=48 takmin
1
250
私のAWS愛を聞け！ ~ここが好きだよStep Functions~ #devio2022
808ce3d41280c085f8bdc27dce7ea8fb?s=48 kongmingstrap
0
270
Oracle Database Technology Night #57 Database Services in Oracle Cloud 最新情報アップデートと活用Tips
3115a782126be714b5f94d24073c957d?s=48 oracle4engineer
PRO
0
140
年700万円損するサーバレスの 認可システムをご紹介します！！
Fb0a40e5e7a9dc85520f1646fd41eb44?s=48 higuuu
3
290

Featured

See All Featured
Web development in the modern age
465724d73fe3a92c0879fdfb43a3a6f3?s=48 philhawksworth
197
9.3k
Fontdeck: Realign not Redesign
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
73
4.1k
Fireside Chat
864a009ac73600c7c02e1f26629dd989?s=48 paigeccino
13
1.4k
Put a Button on it: Removing Barriers to Going Fast.
Bfd6b681ec6e8c9bef82ff0521c364f7?s=48 kastner
56
2.3k
Stop Working from a Prison Cell
C1daf20e5c49ff910745198ef9869ac2?s=48 hatefulcrawdad
262
17k
The Art of Programming - Codeland 2020
719435d98d452de7ac367c828266cf01?s=48 erikaheidi
32
11k
How GitHub (no longer) Works
78b475797a14c84799063c7cd073962f?s=48 holman
297
140k
YesSQL, Process and Tooling at Scale
D09fad3e36ae6841f54820be0e907f7a?s=48 rocio
157
12k
Thoughts on Productivity
A16eb159db895e3b01d3dc95767ad595?s=48 jonyablonski
44
2.4k
Designing the Hi-DPI Web
C157b16234f1e75e8eac3698c1d4414a?s=48 ddemaree
272
32k
Making Projects Easy
C4de88ea47538e4594750e3861a341c8?s=48 brettharned
98
4.4k
4 Signs Your Business is Dying
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
169
20k

Transcript

  1. 5FSSBGPSNY01"$POGUFTUͷ UJQT Open Policy Agent Rego 
 Knowledge Sharing Meetup

    #2021.07 Ryo Kubota @ryok6t

  2. • Ryo Kubota (@ryok6t) • FiNC Technologies • SRE Team

    manager ࣗݾ঺հ

  3. લఏ • ϚΠΫϩαʔϏεΛ AWS EKS ্ʹσϓϩΠ • ֤αʔϏεͷΠϯϑϥ͸ҎԼͰίʔυ؅ཧ • Kubernetes

    ͷ manifest • Terraform • ֤։ൃνʔϜ͕ࣗ਎Ͱ͜ΕΒͷίʔυΛॻ͍͍ͯΔ • ࣭ͷ୲อͷͨΊʹ Conftest Λར༻

  4. Ҏલͷൃද • https://speakerdeck.com/ryokbt/terraformfalserebiyuwoconftestdezi-dong-hua-suru

  5. ຊ೔ͷ಺༰ • ʢಛʹʣTerraform Ͱ OPA Λ࢖͏৔߹ͷͪΐͬͱͨ͠ίπ • ࣗ෼͕ OPA Λಋೖ͢Δલʹ஌Γ͔ͨͬͨ͜ͱͷ·ͱΊ

  6. ·ͣ͸QMBOΛ+40/ʹ • plan ݁ՌΛ JSON ʹ͢Δͱ͜Ζ͔Β • terraform plan -out

    plan.tfplan • terraform show -json plan.tfplan | conftest test -

  7. 5FSSBGPSNQMBOͷ+40/ ϦιʔεͱͦΕʹର͢ΔมߋҰཡ Ճ͑Δૢ࡞ʢDSFBUF VQEBUFͳͲʣ Ϧιʔεͷ৘ใ มߋલมߋޙͷঢ়ଶ

  8. ϙϦγʔΛॻ͘ WJPMBUJPOEFOZXBSOͷQSFpYΛ͚ͭΔ • ʮresource type ͕ security group Ͱɺport ͕


    ϑϧΦʔϓϯͳ΋ͷ͕1ݸͰ΋͋Ε͹ violationʯ

  9. ڞ௨ͷॲཧΛ·ͱΊΔ • ڞ௨ͷॲཧΛ͢Δέʔε͕ଟ͍ • e.g. ಛఆͷ resource type ͷ࣌ͷΈద༻͢Δ •

    ઌͷྫͩͱɺsecurity group ͷ͚࣌ͩద༻͢ΔͳͲ • ຖճॻ͘ͷ͸໘౗

  10. GVODUJPOΛ࢖ͬͨڞ௨ॲཧ ड͚औͬͨUZQFʹ
 ౰ͯ͸·Δ΋ͷ͚ͩΛฦ͢

  11. ڞ௨ॲཧΛผͷϑΝΠϧʹ੾Γग़͢ • ڞ௨ॲཧ༻ͷ package Λ࡞͓ͬͯ͘

  12. ڞ௨ॲཧΛผϑΝΠϧ͔Βݺͼग़͢ ڞ௨ॲཧ༻ͷQBDLBHFΛJNQPSU CBTFSFTPVSDFTͰݺͼग़ͤΔΑ͏ʹ

  13. ྫ֎έʔεΛѻ͏ • There is no rule without exceptions • ಛఆͷϦιʔε͚ͩϧʔϧͷର৅֎ʹ͍ͨ͠έʔε͕ଘࡏ

  14. lFYDFQUJPOzΛ࢖ͬͯྫ֎ʹରԠ • ྫ֎ͷϩδοΫʹ౰ͯ͸·ͬͨ৔߹ɺrules Ͱࢦఆͨ͠΋ ͷ͸ແࢹ͞ΕΔ • ҎԼͰ͸ “deny_foo”, “violation_foo” ͳͲ͕ແࢹ͞ΕΔ

  15. ςετΛॻ͘ • Rego ͷจ๏ʹ͸Ϋη͕͋ΔͨΊɺςετ͕ॏཁ • Conftest ࣗମͰ؆୯ʹςετ͕Մೳ

  16. ςετͷํ๏ • foo.rego ʹରͯ͠ɺfoo_test.rego ͱ͍͏ϑΝΠϧΛ༻ҙ • conftest verify Λ࣮ߦ

  17. ςετͷྫʢWJPMBUJPOʹͳΔέʔεʣ ϑϧΦʔϓϯʹͳ͍ͬͯΔͷͰ
 WJPMBUJPOʹͳΔ͜ͱΛςετ

  18. ςετίʔυͷߏ଄ QMBOͷ+40/ͱಉ͡ߏ଄Ͱ ςετσʔλΛੜ੒ XJUIBTΛ࢖ͬͯ
 ςετσʔλΛ༩͑Δ

  19. ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε

  20. ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε • not Λ͚ͭΔ͚ͩ

  21. ςετσʔλʹ͍ͭͯ • ެࣜυΩϡϝϯτͰ͸ɺςετίʔυʹ JSON Λ௚઀
 ॻ͍͍ͯΔ • Ҿ༻: https://www.openpolicyagent.org/docs/latest/policy-testing/

  22. ςετσʔλʹ͍ͭͯ • ͔͠͠ JSON Λ௚઀ॻ͘ͱਏ͍έʔε͕ଟ͍ • ݱࡏ͸ yaml Ͱॻ͍ͯ yaml.unmarshal

    ͍ͯ͠Δ

  23. ࠷ޙʹσόοάʹ͍ͭͯ • policy ΍ͦͷςετΛॻ͍͍ͯΔͱσόοά͕ͨ͘͠ͳΔ • ೚ҙͷՕॴʹ trace(string) Λ࢓ࠐΉ͜ͱͰσόοάग़ྗ ͕Մೳ •

    `—trace` Φϓγϣϯ෇͖Ͱ Conftest Λ࣮ߦ