4 ms·
In the Terraform use case, that is probably possible if you hack together an analysis of the JSON policy files generated by the Terraform module and then allow/
by kmcquade 7y ago
In the Terraform use case, that is probably possible if you hack together an analysis of the JSON policy files generated by the Terraform module and then allow/warn/deny based on the results. Alternatively, you could run the IAM analysis portion of this tool after Terraform apply.
I should also mention that the IAM authoring aspect of this tool is more mature than the policy analysis feature.
In CI/CD, if you are using Terraform, I suggest using Open Policy Agent for blocking access to certain resources by evaluating a Terraform plan. I suppose it's also possible to use OPA to evaluate the JSON output of a policy_sentry YML file.
Hope this helps.
- philsnow 7y agohttps://www.openpolicyagent.org/docs/latest/terraform/ https://www.openpolicyagent.org/docs/latest/terraform/ very neat, I hadn't seen opa used in this way before.
- kmcquade 7y agoOh yeah it's super powerful. And it's not vendor-dependent like Sentinel & TF Enterprise (although I really love TF Cloud). Here's an example of using OPA + Conftest with Terraform that you might be interested in: https://github.com/kmcquade/conftest-terraform-multifolder-policies https://github.com/kmcquade/conftest-terraform-multifolder-p...