anderseknert

{
    "funcs": {
        "funcs": [
            {
                "name": "g0.data.policy.is_admin",
                "params": [
                    0,
                    1
                ],
                "return": 2,

anderseknert

{
    "plans": {
        "plans": [
            {
                "name": "policy/allow",
                "blocks": [
                    {
                        "stmts": [
                            {
                                "type": "CallStmt",

anderseknert

{
    "static": {
        "strings": [{"value": "result"}, {"value": "user"}, {"value": "roles"}, {"value": "admin"}],
        "builtin_funcs": [
            {
                "name": "internal.member_2",
                "decl": {
                    "args": [{"type": "any"}, {"type": "any"}],
                    "result": {"type": "boolean"},
                    "type": "function"

anderseknert

package policy

import future.keywords.if
import future.keywords.in

allow if is_admin

is_admin if "admin" in input.user.roles

anderseknert

package policy

# Note the use of the allowed is_object function here
response := is_object({
    "method": "GET",
    "url": "https://www.openpolicyagent.org"
})

# This would work (and send a HTTP request) even though
# the http.send built-in function had been declared unsafe

anderseknert

#!/usr/bin/env python3

import json
import os
import subprocess
import tempfile
import yaml


yaml.SafeDumper.org_represent_str = yaml.SafeDumper.represent_str

anderseknert

deny["S3 Bucket: 'AccessControl' attribute value must be 'Private'"] {
    not bucket_is_private
}

anderseknert

bucket_is_private {
    input.resource.properties.AccessControl == "Private"
}

anderseknert

{
    "myS3Bucket": {
        "Type": "AWS::S3::Bucket"
    }
}

anderseknert

#!/usr/bin/env python3

import requests

def main():
    base = "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide"
    resp = requests.get(f"{base}/toc-contents.json")

    body = resp.json()