_test.rego filename suffix

test_ function prefix

positive and negative test cases

tests pass

import rego.v1

default allow := false

Reads roles from JWT claims

Reads role grants from data

Nested iteration with some

Permission match on action and resource_type

Tests pass

import rego.v1

Partial set rule for violations

Iterates over conflicting pairs with array-of-arrays membership

Reads user roles from data

Tests pass

import rego.v1

default allow := false

JWT decoded with io.jwt.decode

Matches on input.method and input.path

Allow self and manager access

Tests pass

_test.rego filename suffix

test_ function prefix

positive and negative test cases

tests pass

import rego.v1

Default rule value for fallback limit

Per-tier limit lookup

Tests pass

import rego.v1

Set subtraction to detect unknown fields

Checks for required fields

Tests pass

deny contains msg pattern

Checks input.request.kind.kind

Deny rule for privileged containers

Tests pass

_test.rego filename suffix

test_ function prefix

positive and negative test cases

tests pass

violation contains msg pattern

Uses input.review.object

Uses input.parameters for required labels

Tests pass

package has METADATA block with title and description

package has authors or organizations

decision rules have METADATA with title and description

decision rules have entrypoint: true

rules have custom fields

Tests pass

import rego.v1

METADATA block with custom.severity

Uses rego.metadata.rule() at runtime

Violation is a structured object with severity

Tests pass

Package-level metadata annotation

`allow` rule annotated with `entrypoint: true`

No blank lines between metadata and rule

Tests pass

Incremental violations set using `contains`

Boolean allow rule referencing violations

Checks for privileged and missing limits

Tests pass

Uses `in` for membership check (not `!=` in a loop)

sprintf argument count matches format string

Checks for restricted name and missing annotation

Tests pass

Uses `object.keys()` for provided tags

Set subtraction for missing tags

deny contains msg with sprintf

Tests pass

default declaration at the top

Conditional overrides for each tier

No else branches for fallback

Tests pass

Helper functions take explicit container argument

Separate helpers for privileged and resource limit checks

deny contains msg pattern with container name

Tests pass

Imports the package, not individual rules

No redundant aliases

All imports before rules

Tests pass

Uses `some ... in` for iteration

Checks each container image against approved registry

deny contains msg pattern

Tests pass

Uses `in` operator for membership check

Looks up allowed departments from data

import rego.v1 and default allow := false

Tests pass

snake_case for all identifiers

No get_ or list_ prefix on rule names

No package path repetition in rule names

Tests pass

Test file named `authz_test.rego` with `_test` package suffix

Policy package imported and rules referenced via alias

Unique descriptive test names

Tests pass

main response object

Uppercase action strings and CloudFormation input structure

Helper rules for conditions

Three deny rules covering AccessControl and both BlockPublic settings

Tests pass

import rego.v1

object.get input normalization

Tests pass

_test.rego filename suffix

mocks Terraform plan input with `with input as`

includes both positive and negative test cases

tests pass

Uses walk() built-in

Collects resources from all modules

Deny rule for HTTP in description

Tests pass

Provider region check via configuration path

EU data residency deny rule

has_replication helper with multiple function heads

Tests pass

Deny when capabilities block is absent (empty list)

Deny when drop does not include ALL

Capabilities read as a list, not an object

Tests use the real list-shaped mock, not a bare-object mock

action != delete exclusion pattern

supports_tags helper

Safe tag access with object.get

Deny for missing and empty tags

Tests pass

Deny on aws_s3_bucket without inline encryption

Deny on separate encryption resource with invalid algorithm

Helper function for algorithm validation

Tests pass

Checks create and update actions

Deny on aws_s3_bucket without versioning enabled

Deny on separate versioning resource with wrong status

Tests pass