使用 AWS CDK 结合 OPA 实现“策略即代码”

$ cdk --version

$ curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64$ chmod 755 ./opa

$ mkdir cdk-demo$ cd cdk-demo/$ cdk init  --language python --app cdk-demo

$ python3 -m venv .venv

$ source .venv/bin/activate

$ cat >requirements.txt <<EOFaws-cdk.aws-ec2aws-cdk.core-e .EOF
$ pip install -r requirements.txt

cat >app.py <<EOF#!/usr/bin/env python3
import osfrom aws_cdk import corefrom aws_cdk.core import Environmentfrom cdk_demo.cdk_demo_stack import CdkDemoStack
app = core.App()
ACCOUNT = app.node.try_get_context('account') or os.environ.get(    'CDK_DEFAULT_ACCOUNT', 'unknown')REGION = app.node.try_get_context('region') or os.environ.get(    'CDK_DEFAULT_REGION', 'unknown')
AWS_ENV = Environment(region=REGION, account=ACCOUNT)
CdkDemoStack(app, "cdk-demo", env=AWS_ENV)
app.synth()EOF


cat >cdk_demo/cdk_demo_stack.py <<EOF
from aws_cdk import core, aws_ec2

class CdkDemoStack(core.Stack):
    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:        super().__init__(scope, id, **kwargs)
        self.vpc = aws_ec2.Vpc.from_lookup(self, 'default_vpc', is_default=True)                self.sg_ssh = aws_ec2.SecurityGroup(            self,            'ssh',            vpc=self.vpc,            description="Allow SSH from anywhere",            security_group_name="SSH from anywhere"        )        self.sg_ssh.add_ingress_rule(aws_ec2.Peer.any_ipv4(), aws_ec2.Port.tcp(22))
        self.ami = aws_ec2.LookupMachineImage(            name="ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*",            owners=["099720109477"],        )
        self.ec2 = aws_ec2.Instance(            self,            'cdk-demo',            instance_type=aws_ec2.InstanceType('t2.micro'),            machine_image=self.ami,            vpc=self.vpc,            security_group=self.sg_ssh,        )EOF

$ cdk synth

cat > opa_cdk.rego <<EOF
package opa_cdk
import input 
# deny if it creates more than 10 EC2 instancesdeny_too_many_ec2[deny] {                                 instances := [res | res:=input.Resources[_]; res.Type == "AWS::EC2::Instance"]       count(instances) > 10      deny := true}
# deny if ssh is enableddeny_ssh_enabled[deny] {                                 input.Resources[_].Properties.SecurityGroupIngress[_].ToPort == 22    deny := true}
# deny if it creates IAM roledeny_role_created[deny] {                                 input.Resources[_].Type == "AWS::IAM::Role"    deny := true}EOF

cd .../opa eval --format pretty -i cdk-demo/cdk.out/cdk-demo.template.json -d cdk-demo/opa_cdk.rego  "data"