CtrlK
BlogDocsLog inGet started
Tessl Logo

nicholasjackson/opa-rego-language

Rego is the declarative policy language used by Open Policy Agent (OPA). This tile covers writing and testing Rego policies for Kubernetes admission control, Terraform and infrastructure-as-code plan validation, Docker container authorization, HTTP API authorization, RBAC and role-based access control, data filtering, metadata annotations with opa inspect, and OPA policy testing with opa test.

96

1.18x
Quality

94%

Does it follow best practices?

Impact

97%

1.18x

Average score across 32 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

task.mdevals/scenario-27/

Terraform: CloudFormation Hook — S3 Bucket Access Control

We use OPA as a CloudFormation hook to validate resources before they are deployed. Write a Rego policy for an AWS::S3::Bucket hook that enforces private access control.

The policy must deny bucket creation or update when:

  1. The AccessControl property is not "Private"
  2. PublicAccessBlockConfiguration.BlockPublicAcls is not "true"
  3. PublicAccessBlockConfiguration.BlockPublicPolicy is not "true"

The hook receives input in the CloudFormation hook format: input.resource.type, input.action (uppercase: "CREATE" or "UPDATE"), input.resource.id, and input.resource.properties.

The policy response must be a main object with allow (boolean) and violations (set of messages).

evals

scenario-27

criteria.json

task.md

README.md

rules.md

tile.json