OpeTacoでOPAを使ったポリシーテストをやってみる(インラインポリシー)

name: Digger Workflow

on:
  workflow_dispatch:
    inputs:
      spec:
        required: true
      run_name:
        required: false

run-name: '${{inputs.run_name}}'

jobs:
  digger-job:
    runs-on: ubuntu-latest
    permissions:
      contents: write      # required to merge PRs
      actions: write       # required for plan persistence
      id-token: write      # required for workload-identity-federation
      pull-requests: write # required to post PR comments
      issues: read         # required to check if PR number is an issue or not
      statuses: write      # required to validate combined PR status

    steps:
      - uses: actions/checkout@v4
+      - name: Install Conftest
+        run: |
+          LATEST_VERSION=$(curl -s "https://api.github.com/repos/open-policy-agent/conftest/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/' | cut -c 2-)
+          ARCH=$(uname -m | sed 's/x86_64/x86_64/' | sed 's/aarch64/arm64/')
+          SYSTEM=$(uname)
+          curl -L "https://github.com/open-policy-agent/conftest/releases/download/v${LATEST_VERSION}/conftest_${LATEST_VERSION}_${SYSTEM}_${ARCH}.tar.gz" -o conftest.tar.gz
+          tar xzf conftest.tar.gz
+          sudo mv conftest /usr/local/bin
+          conftest --version
      - name: ${{ fromJSON(github.event.inputs.spec).job_id }}
        run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
      - uses: diggerhq/digger@vLatest
        with:
          digger-spec: ${{ inputs.spec }}
          setup-aws: true
          setup-terraform: true
          terraform-version: 1.14.3
          aws-role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package main

# EC2インスタンスに必須タグが設定されているかチェック
required_tags := ["Environment", "Owner", "Name"]

deny contains msg if {
    resource := input.resource_changes[_]
    resource.type == "aws_instance"

    required_tag := required_tags[_]
    not resource.change.after.tags[required_tag]

    msg := sprintf("EC2 instance '%s' is missing required tag: %s", [resource.address, required_tag])
}

$ cd prod
$ terraform plan -out="test.tfplan"
$ terraform show -json test.tfplan > test.json
$ conftest test --policy ../policies test.json
WARN - prod-add-tag.json - main - EC2 instance 'aws_instance.vm_instance' is missing required tag: Environment
WARN - prod-add-tag.json - main - EC2 instance 'aws_instance.vm_instance' is missing required tag: Owner

2 tests, 0 passed, 2 warnings, 0 failures, 0 exceptions

projects:
- name: production
  dir: prod
# 以下を追加
  workflow: my_custom_workflow
workflows:
  my_custom_workflow:
    plan:
      steps:
      - init:
      - plan:
      - run: "terraform show -json $DIGGER_PLANFILE > prod.json"
      - run: "conftest test ./prod.json -p ../policies"
    workflow_configuration:
      on_pull_request_pushed: [digger plan]
      on_pull_request_closed: [digger unlock]
      on_commit_to_default: [digger apply]

time=2026-01-20T06:47:31.234Z level=INFO msg="Running command" command="conftest test ./prod.json -p ../policies" project=hoge/quickstart-actions-aws#production
Error: running test: parse files: get file info: stat ./prod.json: no such file or directory

resource "aws_instance" "vm_instance" {
  ami                    = "ami-05c13eab67c5d8861" # us-east-1 Amazon Linux 2023 AMI 2023.2.20231030.1 x86_64 HVM kernel-6.1
  instance_type          = "t2.micro"
  subnet_id              = aws_subnet.vpc_subnet.id
  vpc_security_group_ids = [aws_security_group.security_group.id]
  tags = {
    Name        = "terraform-instance"
+    Environment = "Production"
+    Owner       = "SatoMasaki"
  }
}