github.com/swisspost/terratest@v0.0.0-20230214120104-7ec6de2e1ae0/examples/terraform-opa-example/policy/enforce_source.rego (about)

     1  # An example rego policy of how to enforce that all module blocks in terraform json representation source the module
     2  # from the gruntwork-io github repo on the json representation of the terraform source files. A module block in the json
     3  # representation looks like the
     4  # following:
     5  #
     6  # {
     7  #   "module": {
     8  #     "MODULE_LABEL": [{
     9  #       #BLOCK_CONTENT
    10  #     }]
    11  #   }
    12  # }
    13  package enforce_source
    14  
    15  
    16  # website::tag::1:: Only define the allow variable and set to true if the violation set is empty.
    17  allow = true {
    18      count(violation) == 0
    19  }
    20  
    21  # website::tag::1:: Add modules with module_label to the violation set if the source attribute does not start with a string indicating it came from gruntwork-io GitHub org.
    22  violation[module_label] {
    23      some module_label, i
    24      startswith(input.module[module_label][i].source, "git::git@github.com:gruntwork-io") == false
    25  }