OPA policy to deny the zero subnet for ingress

user_15284458 0
Viewed 62

Here is a link to the rego playground where I am testing this: https://play.openpolicyagent.org/p/ehfVngUVdO

Basically, Im trying to create a rego policy that will not allow 0.0.0.0/0 to occupy the source range of a firewall rule. I have two separate methods Im trying to use in order to catch the zero subnet.

Rego Policy:

package play

default allow = true


allow = false {

    input.vpcs[_].rule.sourceRanges[_] == "0.0.0.0/0"
}

allow = false {

    contains("0.0.0.0/0", input.vpcs[_].rule.sourceRanges[_])
}

and the code that Im running it against:

[
    {
        "vpcs": {
            "rule": {
                "sourceRanges": "0.0.0.0/0,10.186.2.128/25,10.190.70.128/25"
            }
        }
    }
]

Can anyone help? I dont know what I am doing wrong as the result always comes out "true", regardless of the 0.0.0.0/0 being present.

opa
1 Answers

This turned out to be the answer:

package play

default allow = true

allow = false {
    sourceRanges := input[_].vpcs.rule.sourceRanges
    sourceRange := split(sourceRanges, ",")[_]
    
    trim_space(sourceRange) == "0.0.0.0/0"
}
user_152844580
Related