I am new to conftest and running some test cases. See below.
secgroup.rego
<code># Rule: Block open ingress
deny_open_ingress[msg] {
resource.type == "aws_security_group"
rule := resource.values.ingress[_]
contains(rule.cidr_blocks[_], "0.0.0.0/0")
msg = sprintf("Resource %s has an open ingress")
}
</code>
<code># Rule: Block open ingress
deny_open_ingress[msg] {
resource.type == "aws_security_group"
rule := resource.values.ingress[_]
contains(rule.cidr_blocks[_], "0.0.0.0/0")
msg = sprintf("Resource %s has an open ingress")
}
</code>
# Rule: Block open ingress
deny_open_ingress[msg] {
resource.type == "aws_security_group"
rule := resource.values.ingress[_]
contains(rule.cidr_blocks[_], "0.0.0.0/0")
msg = sprintf("Resource %s has an open ingress")
}
secgroup_test.rego
<code># Unit test
package main
test_has_violations {
cfg := parse_config_file("main.tf")
count(deny_open_ingress) > 0 with input as cfg
}
test_has_no_violations {
cfg := parse_config_file("main.tf")
count(deny_open_ingress) == 0 with input as cfg
}
</code>
<code># Unit test
package main
test_has_violations {
cfg := parse_config_file("main.tf")
count(deny_open_ingress) > 0 with input as cfg
}
test_has_no_violations {
cfg := parse_config_file("main.tf")
count(deny_open_ingress) == 0 with input as cfg
}
</code>
# Unit test
package main
test_has_violations {
cfg := parse_config_file("main.tf")
count(deny_open_ingress) > 0 with input as cfg
}
test_has_no_violations {
cfg := parse_config_file("main.tf")
count(deny_open_ingress) == 0 with input as cfg
}
Running conftest test I get the expected behavior:
<code>WARN - tfe_opa_input.json - main - Resource aws_security_group.test-sg has an open ingress
</code>
<code>WARN - tfe_opa_input.json - main - Resource aws_security_group.test-sg has an open ingress
</code>
WARN - tfe_opa_input.json - main - Resource aws_security_group.test-sg has an open ingress
Now unit test conftest verify
<code>FAIL - policy/secgroup_test.rego - - data.main.test_has_violations
2 tests, 1 passed, 0 warnings, 1 failures, 0 exceptions, 0 skipped
</code>
<code>FAIL - policy/secgroup_test.rego - - data.main.test_has_violations
2 tests, 1 passed, 0 warnings, 1 failures, 0 exceptions, 0 skipped
</code>
FAIL - policy/secgroup_test.rego - - data.main.test_has_violations
2 tests, 1 passed, 0 warnings, 1 failures, 0 exceptions, 0 skipped
From my undertsanding with unit testing all tests should pass. Am I doing something wrong or I am on track? I just want to see a PASS on all my test. In my main TF I have an open ingress on port 22 so I am assuming that’s expected to fail on the test unless I am missing something.
Thanks in advance.