fugue / regula

Regula checks infrastructure as code templates (Terraform, CloudFormation, k8s manifests) for AWS, Azure, Google Cloud, and Kubernetes security and compliance using Open Policy Agent/Rego

Home Page:https://regula.dev/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[BUG] Validate after_unknown attribute with terraform plan

martingaleano opened this issue · comments

Describe the bug
When I run the validation, conftest returns a Failure result because it's not validating with after_unknown attribute in JSON terraform plan.
If I move manually some attribute inside that block to planned_values block, it works successfully. I don't know why conftest/OPA is not including after_unknown block

How you're running Regula

I'm running this command

docker run --rm -v $(pwd):/project openpolicyagent/conftest test tfplan33.json --output table

using the policies located in this repository.
Operating System
Ubuntu 22

Steps to reproduce
A minimal set of steps that we can use to reproduce the issue. You can exclude this section if you already covered it in the "How you're running Regula" section above.

IaC Configuration
The common tf plan, the result of:

terraform plan -out=tfplan
terraform show -json ./tfplan > tfplan33.json