How to leverage OPA (Open Policy Agent) to Shift-Left Testing IaC (Infrastructure as Code)

1. Shift-Left Testing IaC
With PaC

2. HELLO!
I am smalltown
MaiCoin Site Reliability Engineer
Taipei HashiCorp UG Organizer
AWS UG Taiwan Staff
2

3. 3
IaC PaC OPA Case I: TF Case II: K8S

4. 4
IaC PaC OPA Case I: TF Case II: K8S

5. Infrastructure as Code
▪ The Process of Managing And Provisioning
Computer Data Centers Through
Machine-Readable Definition Files
5

6. IaC First Generation
~$ apt-get update
~$ apt-get install -y
tar=1.16.1
package 'tar' do
version '1.16.1'
action :install
end
👉 Record Your Provision Procedure with CM
Tool, Not Document !
6

7. 7
R.I.P. Configuration Management

8. Why?
Stateful Service
Stateless Service
Cloud Provider
Orchestrator
8

9. IaC Second Generation
👉 Record Your Cloud Resource with IaC Tool,
Not Document !
resource "aws_s3_bucket" "b" {
bucket = "my_tf_test_bucket"
acl = "private"
tags { Name = "My_bucket" }
}
9

10. 10
IaC Second Generation is Hot Now!
… etc
AWS CDKPulumiTerraform

11. Everything As Code
Could You Write Code Without Tests?
11

12. Not General Testing Today
Unit, Function, Integration, Performance
12

13. More Security and Compliance Testing
▪ Perform Vulnerability Scanning
▫ SAST, RASP, DAST, IAST
▪ Ensure Compliance, Security Follow the Policy
▫ Traditional Auditing
▪ Have You Ever Been Audited?
13

14. 14
Excel Engineer
▪ Lots of Spreadsheets
▪ Lots of Manual Process
▪ Takes Weeks to Months to
Complete Review and Fix
▪ Policy Document Not Ready
Yet
▪ But The Most Terrible ...

15. Shift Left Testing
Testing is Performed Earlier in the Life Cycle
15

16. Development Life Cycle
Local
Development
Continuous
Integration
Production
Environment
Fast Slow Slower
16

17. Development Life Cycle
Local
Development
Continue
Integration
Production
Environment
Auditing
17

18. Development Life Cycle
Local
Development
Continue
Integration
Production
Environment
Automation Auditing
18

19. IaC PaC OPA Case I: TF Case II: K8S
19

20. Audit CodePolicy
How to Achieve Automation Auditing?
20

21. What is Policy?
▪ Compliance Policies: Ensure Compliance with
External Standards (PCI-DSS, SOC, or GDPR)
▪ Security Policies: Adopted Internally Protect Data
Privacy and Infrastructure Integrity
▪ Operational Excellence: Prevent Service Outages
or Degradation
Ref
21

22. Some Policy as Code Tools
▪ ModSecurity: Only Focus on Web Application
Firewall (Capital One Event)
▪ Sentinel: Only Support Terraform, Vault, Nomad and
Consul Enterprise (HashiCorp)
▪ Inspec: High-Quality Shared Content, Only For
Programmer (Chef)
▪ Open Policy Agent: Solve Different Problems,
Limited Shared Content
22

23. 23

24. 24
IaC PaC OPA Case I: TF Case II: K8S

25. What is Open Policy Agent?
OPA
Service
Policy
(Rego)
Data
(JSON)
Request,
Event, etc
Query
Decision
25

26. OPA Features
▪ Declarative Policy Language (Rego)
▪ Library, Sidecar, Host-Level Daemon
▪ Management API for Control & Observability
▪ Tooling to Build, Test and Debug Policy
26

27. OPA Integrations
Admission Control
API AUthorization
SSH & sudo
Data Protection
Data Filtering
Linux PAM
27

28. How Does OPA Work?
▪ Example Policy: Employees
Can Read Their Own Salary
And The Salary of Anyone
They Manage
28

29. Rego Demonstration
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “koreanfish”
29

30. Rego Demonstration
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “koreanfish”
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = employ_id
}
30

31. Rego Demonstration
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “koreanfish”
allow = true {
input.method = “GET”
input.path = [“salary”, “koreanfish”]
input.user = “koreanfish”
}
31

32. Rego Demonstration
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “whitedolphin”
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = employ_id
}
Different User Now!
32

33. Rego Demonstration
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “whitedolphin”
allow = true {
input.method = “GET”
input.path = [“salary”, “koreanfish”]
input.user = “koreanfish”
}
Different User Now!
This Statement Will Fail!
33

34. Rego Demonstration
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “whitedolphin”
Context Data:
{ “managers”: {
“koreanfish”: [“whitedolphin”],
“williamboy”: [“vegetenglish”] }
}
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = employ_id
}
34

35. 35
Rego Demonstration
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = employ_id
}
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = managers[employee_id][_]
}
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “whitedolphin”
Context Data:
{ “managers”: {
“koreanfish”: [“whitedolphin”],
“williamboy”: [“vegetenglish”] }
}

36. 36
Rego Demonstration
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = employ_id
}
allow = true {
input.method = “GET”
input.path = [“salary”, “koreanfish”]
input.user = managers[“koreanfish”][_]
}
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “whitedolphin”
Context Data:
{ “managers”: {
“koreanfish”: [“whitedolphin”],
“williamboy”: [“vegetenglish”] }
}

37. 37
Rego Demonstration
allow = true {
input.method = “GET”
input.path = [“salary”, employee_id]
input.user = employ_id
}
allow = true {
input.method = “GET”
input.path = [“salary”, “koreanfish”]
input.user = “whitedolphin”
}
Input Data:
method: “GET”
path: [“salary”, “koreanfish”]
user: “whitedolphin”
Context Data:
{ “managers”: {
“koreanfish”: [“whitedolphin”],
“williamboy”: [“vegetenglish”] }
}

38. 38
IaC PaC OPA Case I: TF Case II: K8S

39. Network Misconfigurations
Are Major Source Of Reliability and Security Issues
39

40. A Normal Day In The Cloud World
▪ AAA Company’s ElasticSearch Leak Customer Data
▪ BBB Company’s Kubernetes Admin Console Can Be
Accessed Publicly
▪ CCC Company’s MongoDB Leak Customer Data
▪ ...
40

41. Someone Create A Server in AWS...
0.0.0.0/0
41

42. Test Terraform With OPA
Policy
(Rego)
1. Terraform Output Plan
Result As Json File
2. OPA Test The Json
Input Through Policy
42

43. 43
https://github.com/smalltown/policy-as-code

44. Benefits
▪ Help Individual Developers Sanity Check Their
Terraform Changes
▪ Auto-Approve Run-Of-The-Mill Infrastructure
Changes And Reduce The Burden of Peer-Review
▪ Help Catch Problems That Arise When Applying
Terraform To Production After Applying It To Staging
44

45. 45
IaC PaC OPA Case I: TF Case II: K8S

46. How to Audit K8S Cluster?
▪ Require Specific Labels On All Resources
▪ Require Container Images Come The Corporate Image
Registry
▪ Require All Pods Specify Resource Requests
And Limits.
▪ ...
46

47. How OPA Audit K8S
API Server OPA
kubectl
CI/CD Pipelines
controllers
AdmissionReview
(Request)
AdmissionReview
(Response)
47

48. One application was
OOM, it causes Pods in
the same node also
were affected 🍯
What the root cause
of the K8S incident
happened before
dawn 🤔
48

49. 49
https://github.com/smalltown/policy-as-code

50. More Use Cases
Cloud
Host sshd
Container
HTTP API
APP
Host
DB
orchestrator
Admission Control
Container Execution, SSH, sudo
Microservice APIs
Risk Management
Data Protection & Filtering
50

51. Takeaways
▪ IaC History
▪ Shift-Left Testing IaC by Automation PaC
▪ OPA Introduction & Features
▪ Demo How OPA Integrate with Terraform & K8S
51

52. THANKS!
ANY QUESTIONS?
You can find me at:
▪ facebook.com/smalltown0110
▪ smalltown@awsug.tw
52

53. 53
🎅 Software Engineer I 🎅 Software Engineer in
Test
🎅 Software Engineer II 🎅 Project Manager