Designing a policy language prototype
I've been working with Terraform for a couple of years now, as well as a couple of compliance languages that Terraform Cloud/Enterprise products support (Open Policy Agent and Hashicorp Sentinel).
Generally, these are implemented in very large organizations that are advanced users of Terraform. The learning curve is significant, particularly if you are not both a developer and well-versed in Terraform JSON plan structure.
I thought it would be an interesting and entertaining project to prototype a policy language that uses extremely simple phrasing that is completely human readable (and by extension writable).
A simple policy might read something like:
“All awsebsvolume must have tag foo: bar” or
“Any awscloudtrail must have includeglobalserviceevents set to True”
I ultimately decided to use Raku lang to create my prototype, primarily because I enjoy writing in it and thought this would be a good project with few requisite libraries (which aren't always full featured/maintained) and potentially a good use case for Grammars (once I actually figure out how to use them, my initial forays into the documentation have not been fruitful)
The initial goal is to have a simple evaluation of a single policy manually invoked against a JSON planfile, which will print violations.
After wrestling with .grep syntax for awhile, I came up with a very simple initial subroutine to let me poke around the plan structure:
use JSON::Fast;
my $plan = from-json "example-plan.json".IO.slurp;
my $resource-changes = $plan<resource_changes>;
# There's no reason to expect that non-managed resources will be needed.
sub get-resource-type (@resource-list, Str $resource-type, Str $mode="managed") {
@resource-list.grep: { $_<mode> eq $mode && $_<type> eq $resource-type }
}
say get-resource-type($resource-changes, "aws_ebs_volume");
I've since added more LOC and made things worse. However, I look forward to getting a minimum prototype working and then breaking things out into modules/classes.