Rego code - Help Needed!!!

[sbalakrishn]

Hi Can someone help solve this for me

Playground : Please check this link below
https://play.openpolicyagent.org/p/R0KewEDshN

I need to evaluate the JSON

"allow_update_a": true,
"allow_update_caa": true,
"allow_update_cname": true,
"allow_update_ns": true,
"deny": [ with a deny message here for MX record ]

[srenatus]

👉 https://play.openpolicyagent.org/p/0W4YtEmda0 I gave it a go here:

package example

import future.keywords.every
import future.keywords.if
import future.keywords.in

default allow_update_cname := false
allow_update_cname if some resource in resources("CNAME")

default allow_update_a := false
allow_update_a if some resource in resources("A")

default allow_update_ns := false
allow_update_ns if some resource in resources("NS")

default allow_update_caa := false
allow_update_caa if some resource in resources("CAA")

resources(type) := {r | some r in input[""]; r.type == type}

deny[msg] {
	some resource in resources("MX")
	msg := sprintf("dns_record '%v' Our policy recommends no changes to MX records", [resource])
}

The policy there evaluates to

{
    "allow_update_a": true,
    "allow_update_caa": true,
    "allow_update_cname": false,
    "allow_update_ns": true,
    "deny": [
        "dns_record '{\"type\": \"MX\", \"values\": [{\"exchange\": \"aspmx.l.google.com.\", \"preference\": 1}, {\"exchange\": \"alt1.aspmx.l.google.com.\", \"preference\": 5}, {\"exchange\": \"alt2.aspmx.l.google.com.\", \"preference\": 5}, {\"exchange\": \"alt3.aspmx.l.google.com.\", \"preference\": 10}, {\"exchange\": \"alt4.aspmx.l.google.com.\", \"preference\": 10}]}' Our policy recommends no changes to MX records"
    ]
}

allow_update_cname can't be true since there's no CNAME in the resources. But I might have misunderstood the question -- is this what you've been looking for?

[srenatus]

I guess you could keep it simple then: https://play.openpolicyagent.org/p/MuLh1OXrTj

package example

import future.keywords.every
import future.keywords.if
import future.keywords.in

resources(type) := {r | some r in input[""]; r.type == type}

deny[msg] {
	some resource in resources("MX")
	msg := sprintf("dns_record '%v' Our policy recommends no changes to MX records", [resource])
}

allow if every record in input[""] { record.type != "MX" }

Two variants here: a deny rule that could collect multiple violations, and an allow rule that will only be true if the condition is met.

[sbalakrishn]

Thank you , for getting back so quickly -- I will try this and get back to you Thank you very very much once again

[sbalakrishn]

Hey It works fine ..
One last things can we add one more deny message for record "SOA"
is it possible via OPA to have two deny messages in this case

[srenatus]

You can have any number of deny[msg] rules, see https://play.openpolicyagent.org/p/dKcBbkrysN.

[sbalakrishn]

@srenatus , I cannot thank enough for this help . It indeed helps me resolve my complete issue .
Thank you very much srenatus it a great help :) Delighted ...Wish you have a good day...take care