CtrlK
BlogDocsLog inGet started
Tessl Logo

nicholasjackson/opa-rego-language

Rego is the declarative policy language used by Open Policy Agent (OPA). This tile covers writing and testing Rego policies for Kubernetes admission control, Terraform and infrastructure-as-code plan validation, Docker container authorization, HTTP API authorization, RBAC and role-based access control, data filtering, metadata annotations with opa inspect, and OPA policy testing with opa test.

96

1.18x
Quality

94%

Does it follow best practices?

Impact

97%

1.18x

Average score across 32 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

task.mdevals/scenario-20/

Terraform: S3 Bucket Encryption

We use OPA to validate Terraform plans before they are applied. Write a Rego policy that prevents S3 buckets from being created without server-side encryption.

The policy must handle both ways encryption can be configured:

  1. Inline on the aws_s3_bucket resource (via the server_side_encryption_configuration block)
  2. As a separate aws_s3_bucket_server_side_encryption_configuration resource

Valid encryption algorithms are AES256 and aws:kms.

The policy must support both raw Terraform input and HCP Terraform / Terraform Enterprise input.

evals

scenario-20

criteria.json

task.md

README.md

rules.md

tile.json