Comments (4)
Hello! Please see the below snippets of code you can use to help build Sentinel policies like this:
Example Sentinel function to iterate over all resources in plan
kubernetes_namespaces = func() {
namespaces = []
// Iterate over all the resources in the Terraform plan and
// find kubernetes_namespace resource
for tfplan.resources as type, resource {
if type is "kubernetes_namespace" {
namespaces += [resource]
}
}
// Return a list of kubernetes namespaces found in the Terraform plan
return namespaces
}
Example Sentinel logic to check for existence of mandatory tags
mandatory_tags = [
"TTL",
"Owner",
]
# Instance tag rule
instance_tags = rule {
all aws_instances as _, instances {
all instances as index, r {
all mandatory_tags as t {
r.applied.tags contains t
}
}
}
}
from terraform-guides.
Thanks for your snippet. I also tried many ways to compare two lists, for example, I wanted to compare list of security group ids of a vm with a mandatory_security_groups list and verify if all mandatory security groups are there. I took the mandatory_tags example and modified but could not achieve. Could you help me here.
from terraform-guides.
I get an error with your snippet, "only a list or map can be indexed, got undefined"
from terraform-guides.
@rajagopalanrg : sorry for the long delay responding to this post.
The third-generation policies have sentinel modules like tfplan-functions.sentinel and tfconfig-functions.sentinel that have various functions. Each function is documented in a separate file.
The tfplan-functions module does have find_resources_by_provider and find_datasources_by_provider. There are similar functions in the tfconfig-functions module.
Also, I recently updated the third-generation policies that validate that certain labels are on resources of many types for AWS and Azure:
- https://github.com/hashicorp/terraform-guides/blob/master/governance/third-generation/aws/enforce-mandatory-tags.sentinel
- https://github.com/hashicorp/terraform-guides/blob/master/governance/third-generation/azure/enforce-mandatory-tags.sentinel
The policy for GCP is still restricted to a single resource type:
Roger Berlind
Global Technology Specialist
HashiCorp
from terraform-guides.
Related Issues (20)
- Move Sentinel common functions to another repository HOT 1
- no reference to old terraform version in any import files to be used in sentinel policy HOT 3
- Error - r.type is type HOT 2
- 3rd generation plan functions - filter_attribute_is_not_value HOT 1
- I have an update for the require latest modules policy check but, doesn't account for public registry. HOT 2
- Missing `--request POST` HOT 1
- remote: error: File .terraform/providers/registry.terraform.io/hashicorp/azurerm/2.5.0/darwin_amd64/terraform-provider-azurerm_v2.5.0_x5 is 149.41 MB; this exceeds GitHub's file size limit of 100.00 MB HOT 2
- Output Sentinel policy check log in automation scripts
- Plan to split out the sentinel policies? HOT 12
- Publish a release? HOT 4
- Is it possible to scan multiple resources? HOT 5
- AWS enforce mandatory tags doesn't check tags_all for default tags
- aws provider 4 & require-private-acl-and-kms-for-s3-buckets fails on new s3 buckets
- 3
- The output of List format is incorrect when use plan.find_resources or tfplan.resource_changes HOT 2
- Query resources not managed by terraform
- Can we able write a sentinel policy without sentinel mock plan/state file?
- How to handle map of maps in terraform if key is not present
- Run status in terraform automation scripts misses a dollar sign
- Github link goes to 404 page
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-guides.