├── .devcontainer ├── Dockerfile └── devcontainer.json ├── .github ├── PULL_REQUEST_TEMPLATE │ └── rego_policy.md ├── dependabot.yml └── workflows │ └── ci.yml ├── .pre-commit-config.yaml ├── CONTRIBUTING.md ├── LICENSE ├── Makefile ├── README.md ├── _config.yml ├── data ├── docker.yml ├── packages.yml └── terraform.yml ├── docs ├── images │ ├── conftest-violation-output-json.png │ ├── debugging-policies-trace.png │ ├── konstraint-docs.png │ ├── pulling-policies.png │ └── violation-markdown-example.png └── policies.md ├── exceptions ├── conftest-policy-packs.json ├── other-repo.json └── readme.md ├── policies ├── artifacthub-repo.yaml ├── docker │ ├── artifacthub-pkg.yml │ ├── deny_image_unless_from_registry │ │ ├── src.rego │ │ └── src_test.rego │ └── sensitive_keys_in_env_args │ │ ├── src.rego │ │ └── src_test.rego ├── lib │ ├── docker_functions.rego │ ├── packages_functions.rego │ └── util_functions.rego ├── packages │ ├── artifacthub-pkg.yml │ ├── nodejs_must_use_recent_version │ │ ├── src.rego │ │ └── src_test.rego │ ├── nodejs_package_must_use_org_scope │ │ ├── src.rego │ │ └── src_test.rego │ └── nodejs_use_publishConfig │ │ ├── src.rego │ │ └── src_test.rego └── terraform │ ├── artifacthub-pkg.yml │ ├── block_public_acls_s3 │ ├── src.rego │ └── src_test.rego │ ├── encrypt_s3_buckets │ ├── src.rego │ └── src_test.rego │ ├── imdsv2_required │ ├── src.rego │ └── src_test.rego │ ├── no_public_rds │ ├── src.rego │ └── src_test.rego │ └── required_tags │ ├── src.rego │ └── src_test.rego └── scripts ├── build-policies.sh └── ci-go-deps.sh /.devcontainer/Dockerfile: -------------------------------------------------------------------------------- 1 | # See here for image contents: https://github.com/microsoft/vscode-dev-containers/tree/v0.202.5/containers/debian/.devcontainer/base.Dockerfile 2 | 3 | # [Choice] Debian version (use bullseye or stretch on local arm64/Apple Silicon): bullseye, buster, stretch 4 | ARG VARIANT="buster" 5 | FROM mcr.microsoft.com/vscode/devcontainers/base:0-${VARIANT} 6 | 7 | # ** [Optional] Uncomment this section to install additional packages. ** 8 | # RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \ 9 | # && apt-get -y install --no-install-recommends build-essential 10 | 11 | -------------------------------------------------------------------------------- /.devcontainer/devcontainer.json: -------------------------------------------------------------------------------- 1 | // For format details, see https://aka.ms/devcontainer.json. For config options, see the README at: 2 | // https://github.com/microsoft/vscode-dev-containers/tree/v0.202.5/containers/debian 3 | { 4 | "name": "Debian", 5 | "runArgs": ["--init"], 6 | "build": { 7 | "dockerfile": "Dockerfile", 8 | // Update 'VARIANT' to pick an Debian version: bullseye, buster, stretch 9 | // Use bullseye or stretch on local arm64/Apple Silicon. 10 | "args": { "VARIANT": "bullseye" } 11 | }, 12 | 13 | // Set *default* container specific settings.json values on container create. 14 | "settings": {}, 15 | 16 | // Add the IDs of extensions you want installed when the container is created. 17 | "extensions": [ 18 | "golang.Go", 19 | "MS-vsliveshare.vsliveshare", 20 | "yzhang.markdown-all-in-one", 21 | "tsandall.opa" 22 | ], 23 | 24 | // Use 'forwardPorts' to make a list of ports inside the container available locally. 25 | // "forwardPorts": [], 26 | 27 | // Uncomment to use the Docker CLI from inside the container. See https://aka.ms/vscode-remote/samples/docker-from-docker. 28 | // "mounts": [ "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind" ], 29 | 30 | // Uncomment when using a ptrace-based debugger like C++, Go, and Rust 31 | // "runArgs": [ "--cap-add=SYS_PTRACE", "--security-opt", "seccomp=unconfined" ], 32 | 33 | // Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root. 34 | "remoteUser": "vscode", 35 | "features": { 36 | "git": "latest", 37 | "github-cli": "latest", 38 | "homebrew": "latest", 39 | "golang": "latest" 40 | }, 41 | "onCreateCommand": "make install" 42 | } 43 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE/rego_policy.md: -------------------------------------------------------------------------------- 1 | # Adding Rego Policy: RALLY-XXXX 2 | 3 | ## Description 4 | 5 | -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | version: 2 2 | updates: 3 | 4 | - package-ecosystem: "github-actions" 5 | directory: "/" 6 | schedule: 7 | # Check for updates to GitHub Actions every weekday 8 | interval: "daily" 9 | -------------------------------------------------------------------------------- /.github/workflows/ci.yml: -------------------------------------------------------------------------------- 1 | name: Conftest CI 2 | 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | 8 | jobs: 9 | test: 10 | name: 'Pre-Commit Checks' 11 | runs-on: ubuntu-latest 12 | steps: 13 | - uses: actions/checkout@v2.4.0 14 | 15 | # Pre-req for the pre-commit action 16 | - uses: actions/setup-python@v2.2.2 17 | with: 18 | python-version: '3.9' 19 | 20 | - uses: actions/setup-go@v2.1.4 21 | with: 22 | go-version: '^1.16' 23 | 24 | - name: Set up Homebrew 25 | id: set-up-homebrew 26 | uses: Homebrew/actions/setup-homebrew@master 27 | 28 | # If the version of konstraint updates during the lifetime of an open PR, the 29 | # caching benefits will disappear. 30 | # In the general case, this cuts ~3 minutes from this job. 31 | - name: 'Cache Go' 32 | uses: actions/cache@v2 33 | with: 34 | path: | 35 | ~/.cache/go-build 36 | ~/go/ 37 | key: ${{ runner.os }}-go-${{ github.ref }} 38 | restore-keys: | 39 | ${{ runner.os }}-go- 40 | 41 | - name: 'Install Dependencies' 42 | run: | 43 | brew install conftest 44 | ./scripts/ci-go-deps.sh 45 | 46 | - name: 'Pre-Commit Checks' 47 | uses: pre-commit/action@v2.0.3 48 | 49 | - name: "Ensure data files are correct file type" 50 | run: | 51 | # This will exit 1 if any files are found with a different file extension 52 | if [[ $(find ./data -maxdepth 1 -type f -not -name "*.yml") != "" ]]; 53 | then 54 | echo "::error::Some files in data/ do not have .yml extensions" 55 | exit 1 56 | fi 57 | -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- 1 | repos: 2 | - repo: https://github.com/anderseknert/pre-commit-opa 3 | rev: v1.5.0 4 | hooks: 5 | - id: conftest-fmt 6 | - id: conftest-verify 7 | args: ['--data', 'data/', '--policy', 'policies/', '--output', 'github'] 8 | 9 | - repo: local 10 | hooks: 11 | - id: gen-policies 12 | name: Generate Documentation 13 | entry: scripts/build-policies.sh 14 | language: script 15 | files: policies|\.md 16 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing 2 | 3 | 4 | - [Local Setup](#local-setup) 5 | - [IDE Plugin](#ide-plugin) 6 | - [Commits](#commits) 7 | - [Adding Rego Policies](#adding-rego-policies) 8 | - [Writing Policies](#writing-policies) 9 | - [Policy Documentation](#policy-documentation) 10 | - [Policy ID](#policy-id) 11 | - [Testing Policies](#testing-policies) 12 | - [Troubleshooting Policies](#troubleshooting-policies) 13 | 14 | 15 | # Local Setup 16 | 17 | [Install Homebrew](https://brew.sh/) on OSX or Linux. 18 | 19 | Run `make install`. 20 | 21 | We use [konstraint](https://github.com/plexsystems/konstraint) to generate Rego policy documentation and [mdtoc](https://github.com/kubernetes-sigs/mdtoc) to 22 | generate markdown table-of-contents. 23 | 24 | ## IDE Plugin 25 | 26 | We recommend the [official Open Policy Agent](https://plugins.jetbrains.com/plugin/14865-open-policy-agent) plugin 27 | for Jetbrains IDEs. 28 | 29 | We recommend [tsandall.opa](https://marketplace.visualstudio.com/items?itemName=tsandall.opa) for Visual Studio Code. 30 | 31 | ## Commits 32 | 33 | This project follows [semantic commit messages](https://karma-runner.github.io/latest/dev/git-commit-msg.html). 34 | 35 | Format of a commit message: 36 | 37 | ``` 38 | (): 39 | 40 | 41 | 42 |