Is this rego suitable to check for Terraform misconfigs?

[l3112]

I've made a rego policy, to check for misconfigs in a Terraform code, but Trivy isn't recognizing it. Not sure if it's an issue with my rego or Trivy.

• The idea is that buckets that do not begin with ca_ cannot be pushed to prod.
• I'm using Terraform for AWS.
• The repo is here; Rego-Trivy

? Do I need user.terraform.ID002?
? Am I calling the wrong elements in my rego code? (ex. should something be resource.aws_s3_bucket)?

[anderseknert]

Hi @l3112 👋 Might be better to ask in a Trivy channel for the bits that are Trivy specific, but as for the Rego, you have multiple package declarations — one on line 11 and one on 28. That's not valid in Rego, and the result of evaluation is a parse error:

opa eval -f pretty -d t.rego data
1 error occurred: t.rego:28: rego_parse_error: unexpected package

[l3112]

Whoops -- one of those packages was a demo I should have removed. Thanks!

[anderseknert]

Does it work now? :)

[l3112]

Not yet! Sent from Yahoo Mail on Android On Thu, May 25, 2023 at 3:13 AM, Anders ***@***.***> wrote: Does it work now? :) — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: ***@***.***>