Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Terraform x OPA/Conftest の tips

6c366ab6293eb42aec0e6f5f69b50882?s=47 Ryo Kubota
July 07, 2021
Technology
0
240

Terraform x OPA/Conftest の tips

OPA/Conftest で Terraform を扱う際の tips のまとめ

6c366ab6293eb42aec0e6f5f69b50882?s=128

Ryo Kubota

July 07, 2021
Tweet

More Decks by Ryo Kubota

See All by Ryo Kubota
6c366ab6293eb42aec0e6f5f69b50882?s=48 ryokbt
2
430
6c366ab6293eb42aec0e6f5f69b50882?s=48 ryokbt
0
1.2k

Other Decks in Technology

See All in Technology
6f455f3ddfaa8a1c3a8a03ecd5d73d4f?s=48 hirakichi
0
130
96c31fe94f5e9b0eef4a606eaadcbc04?s=48 yoshiiryo1
2
420
D8e3492ad16d2087b7cb8b2f6c4d3eb9?s=48 iseki
1
170
13725f35541aa680ed5f85d16b85947a?s=48 tacck
1
340
380bcd2ab751f5838abd8219df53e5fe?s=48 tomoki10
5
3.1k
86b08b89a4ccfc0847046d1abe60824a?s=48 yo41sawada
0
480
97b3cca999b52cb5296675ac0a5c12cd?s=48 emiki
2
220
Dc20c893cac0daddd607dfc9a5855d27?s=48 amarelo_n24
1
180
F04edc7cb2099745e5413c754d3d22f5?s=48 benoitc
0
100
A500dfe11c36aa2912eaf33176fe129f?s=48 oyakata2438
0
390
1741a7877b6ff93bf29af4d11c2c895e?s=48 ryan403
0
150
Cd6f9aa17da41e53601364d85c178eb6?s=48 gracefullife
0
310

Featured

See All Featured
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
66
4.1k
78b475797a14c84799063c7cd073962f?s=48 holman
293
130k
91cefdf141106fa10674aae74ce05890?s=48 yeseniaperezcruz
304
32k
Ba530e786553390f3fb271848485681c?s=48 3n
167
22k
A60068bce2e73de3a37ca9d2dbe36092?s=48 bryan
104
11k
9cde37f47e4a800ea081ea42de8d749a?s=48 dougneiner
56
5.5k
B83d5b590577969ee79a5ad845411a7d?s=48 ammeep
660
54k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
687
180k
016edace78ffe826f2348d1e0c504afd?s=48 maggiecrowley
15
770
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
224
15k
D83926c323d4f9289f947b4b4e76b939?s=48 jensimmons
209
10k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
372
43k

Transcript

  1. 5FSSBGPSNY01"$POGUFTUͷ UJQT Open Policy Agent Rego 
 Knowledge Sharing Meetup

    #2021.07 Ryo Kubota @ryok6t

  2. • Ryo Kubota (@ryok6t) • FiNC Technologies • SRE Team

    manager ࣗݾ঺հ

  3. લఏ • ϚΠΫϩαʔϏεΛ AWS EKS ্ʹσϓϩΠ • ֤αʔϏεͷΠϯϑϥ͸ҎԼͰίʔυ؅ཧ • Kubernetes

    ͷ manifest • Terraform • ֤։ൃνʔϜ͕ࣗ਎Ͱ͜ΕΒͷίʔυΛॻ͍͍ͯΔ • ࣭ͷ୲อͷͨΊʹ Conftest Λར༻

  4. Ҏલͷൃද • https://speakerdeck.com/ryokbt/terraformfalserebiyuwoconftestdezi-dong-hua-suru

  5. ຊ೔ͷ಺༰ • ʢಛʹʣTerraform Ͱ OPA Λ࢖͏৔߹ͷͪΐͬͱͨ͠ίπ • ࣗ෼͕ OPA Λಋೖ͢Δલʹ஌Γ͔ͨͬͨ͜ͱͷ·ͱΊ

  6. ·ͣ͸QMBOΛ+40/ʹ • plan ݁ՌΛ JSON ʹ͢Δͱ͜Ζ͔Β • terraform plan -out

    plan.tfplan • terraform show -json plan.tfplan | conftest test -

  7. 5FSSBGPSNQMBOͷ+40/ ϦιʔεͱͦΕʹର͢ΔมߋҰཡ Ճ͑Δૢ࡞ʢDSFBUF VQEBUFͳͲʣ Ϧιʔεͷ৘ใ มߋલมߋޙͷঢ়ଶ

  8. ϙϦγʔΛॻ͘ WJPMBUJPOEFOZXBSOͷQSFpYΛ͚ͭΔ • ʮresource type ͕ security group Ͱɺport ͕


    ϑϧΦʔϓϯͳ΋ͷ͕1ݸͰ΋͋Ε͹ violationʯ

  9. ڞ௨ͷॲཧΛ·ͱΊΔ • ڞ௨ͷॲཧΛ͢Δέʔε͕ଟ͍ • e.g. ಛఆͷ resource type ͷ࣌ͷΈద༻͢Δ •

    ઌͷྫͩͱɺsecurity group ͷ͚࣌ͩద༻͢ΔͳͲ • ຖճॻ͘ͷ͸໘౗

  10. GVODUJPOΛ࢖ͬͨڞ௨ॲཧ ड͚औͬͨUZQFʹ
 ౰ͯ͸·Δ΋ͷ͚ͩΛฦ͢

  11. ڞ௨ॲཧΛผͷϑΝΠϧʹ੾Γग़͢ • ڞ௨ॲཧ༻ͷ package Λ࡞͓ͬͯ͘

  12. ڞ௨ॲཧΛผϑΝΠϧ͔Βݺͼग़͢ ڞ௨ॲཧ༻ͷQBDLBHFΛJNQPSU CBTFSFTPVSDFTͰݺͼग़ͤΔΑ͏ʹ

  13. ྫ֎έʔεΛѻ͏ • There is no rule without exceptions • ಛఆͷϦιʔε͚ͩϧʔϧͷର৅֎ʹ͍ͨ͠έʔε͕ଘࡏ

  14. lFYDFQUJPOzΛ࢖ͬͯྫ֎ʹରԠ • ྫ֎ͷϩδοΫʹ౰ͯ͸·ͬͨ৔߹ɺrules Ͱࢦఆͨ͠΋ ͷ͸ແࢹ͞ΕΔ • ҎԼͰ͸ “deny_foo”, “violation_foo” ͳͲ͕ແࢹ͞ΕΔ

  15. ςετΛॻ͘ • Rego ͷจ๏ʹ͸Ϋη͕͋ΔͨΊɺςετ͕ॏཁ • Conftest ࣗମͰ؆୯ʹςετ͕Մೳ

  16. ςετͷํ๏ • foo.rego ʹରͯ͠ɺfoo_test.rego ͱ͍͏ϑΝΠϧΛ༻ҙ • conftest verify Λ࣮ߦ

  17. ςετͷྫʢWJPMBUJPOʹͳΔέʔεʣ ϑϧΦʔϓϯʹͳ͍ͬͯΔͷͰ
 WJPMBUJPOʹͳΔ͜ͱΛςετ

  18. ςετίʔυͷߏ଄ QMBOͷ+40/ͱಉ͡ߏ଄Ͱ ςετσʔλΛੜ੒ XJUIBTΛ࢖ͬͯ
 ςετσʔλΛ༩͑Δ

  19. ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε

  20. ςετͷྫ WJPMBUJPOʹͳΒͳ͍έʔε • not Λ͚ͭΔ͚ͩ

  21. ςετσʔλʹ͍ͭͯ • ެࣜυΩϡϝϯτͰ͸ɺςετίʔυʹ JSON Λ௚઀
 ॻ͍͍ͯΔ • Ҿ༻: https://www.openpolicyagent.org/docs/latest/policy-testing/

  22. ςετσʔλʹ͍ͭͯ • ͔͠͠ JSON Λ௚઀ॻ͘ͱਏ͍έʔε͕ଟ͍ • ݱࡏ͸ yaml Ͱॻ͍ͯ yaml.unmarshal

    ͍ͯ͠Δ

  23. ࠷ޙʹσόοάʹ͍ͭͯ • policy ΍ͦͷςετΛॻ͍͍ͯΔͱσόοά͕ͨ͘͠ͳΔ • ೚ҙͷՕॴʹ trace(string) Λ࢓ࠐΉ͜ͱͰσόοάग़ྗ ͕Մೳ •

    `—trace` Φϓγϣϯ෇͖Ͱ Conftest Λ࣮ߦ