178 questions
0
votes
0
answers
66
views
Issues with OPA/Reg Policy Compilation to WASM
I'm working on a Rego/OPA policy, specifically for checking azure resources diagnostic settings compliant based on specified parameters. However, I'm having several issues when trying to compile my ...
- 669
0
votes
0
answers
61
views
opa ast library unable to unmarshal my json ast
Iam trying to unMarshal AST json to ast.Module structure of OPA.
policy.rego:
package example.authz
import rego.v1
allow if {
some i
input.users[i].role == "admin"
}
use command ...
- 11
0
votes
1
answer
163
views
Do Rego policies compiled into WASM modules support `http.send`?
The OPA WASM documentation mentions that built-in functions like http.send are not natively supported by WASM.
However, I was able to successfully compile and evaluate WASM modules from Rego policies ...
- 1
0
votes
1
answer
76
views
Rego graph.reachable not printing leaf nodes
I'm trying to get a simple expansion of some relations using Rego's graph.reachable. For some reason this isn't printing leaf nodes and I've not yet figured out why.
inherits_from[role_id] contains ...
- 15.4k
1
vote
2
answers
612
views
How to build OPA Rules from JSON
Is there some program or feature that can turn a JSON object into a policy.rego file?
I am aware there is currently a feature to turn a rego file into a JSON, but have not found anything to reverse ...
- 15
1
vote
0
answers
128
views
Writing an OPA Policy that enforces tagging, but only for AWS resources that allow tagging
In the project I'm working on, we're getting OPA failures because our policy checks for tags on resources, but some resources do not allow tags, such as SNS.
Is it possible to write a policy that can ...
- 59
2
votes
0
answers
94
views
Translating a Rego policy to AWS Cedar
I have the following dummy Rego policy
is_permitted if {
owner := dataowner.resources[input.resource][input.resource_id].owner
permitted_members := data.owners[owner].permissions[input....
- 539
0
votes
1
answer
99
views
rego language multiple rules in same violation
These are rules that are part of a
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
Can you help me understand why this works (preventing the creation of deployments out of the limits):...
- 119
0
votes
1
answer
551
views
How can I return a single value in rego function?
I have the following rego:
retry_count_key := "retry"
get_retries_count(str) := {x |
some i
parts := split(str[i], ":")
parts[0] == retry_count_key
x := to_number(...
- 357
1
vote
1
answer
263
views
syntex error with OPA rego file for authentication
I am writing very simple rego file but it is showing syntex error. Can anyone suggest what am I doing wrong?
package example.accesscontrol
# Define the allowed UPNs
allowed_upns = {"[email protected]&...
1
vote
1
answer
144
views
OPA/REGO Using AND condition to combine two arrays of Boolean values
I whish to combine two arrays of Boolean value using AND.
For example: a1 := [true, true, false], a2 := [false, true, false].
the resulting AND operation:
a3 = a1 AND a2 would be [false, true, false]
- 156
1
vote
1
answer
249
views
How to prevent http.send if subsequent allow's are true?
I am trying to use OPA as authorization service for Trino. I wrote a rego file according to my needs.
package mytrino
import rego.v1
default allow := false
allow if {
input.action.operation == &...
- 55
0
votes
1
answer
888
views
Nested if or some kind of nested condition in OPA rule engine
I am new to OPA rule engine and have tried a few things out, I am unable to write a nested if in opa rule engine like
output := someValue if {
someValue := someOtherValue if {
}
}
I know ...
- 21
0
votes
0
answers
126
views
integrating OPA having external data calls with envoy
I am trying to integrate OPA with Envoy for authorization purposes. It works successfully with OPA without any external data calls, but I need to bundle my auth.rego file with a data.json file to ...
1
vote
1
answer
297
views
Rego object comprehension seems incomprehensible to me; lowercase the keys
In rego, I want to convert this:
d := {"a": "aye", "B": "bEe"}
to:
l := {"a": "aye", "b": "bEe"}
where the keys are ...
- 7,628