如何在Rego中遍历数组内JSON对象，验证client_broker是否为TLS

需求说明 #

要编写Rego规则检查AWS MSK集群的client_broker字段值：如果是TLS则规则通过，否则不通过。但之前的代码无法正确遍历嵌套的数组结构，尝试walk函数也未生效。

尝试的代码 #

deny{
   r := tfplan.resource_changes[_]
   r.type == "aws_msk_cluster"
   name := r.change.after.encryption_info[_]
   #val := walk(name,["encryption_in_transit"],"TLS")
   print(name)
   #print(val)
   contains(name,"TLS")
}

Mock JSON片段 #

"change": {
    "actions": [
        "create"
    ],
    "before": null,
    "after": {
        "broker_node_group_info": [
            {
                "az_distribution": "DEFAULT",
                "instance_type": "kafka.m5.large",
                "storage_info": [
                    {
                        "ebs_storage_info": [
                            {
                                "provisioned_throughput": [],
                                "volume_size": 1000
                            }
                        ]
                    }
                ]
            }
        ],
        "client_authentication": [],
        "cluster_name": "example",
        "configuration_info": [],
        "encryption_info": [
            {
                "encryption_in_transit": [
                    {
                        "client_broker": "TLS",
                        "in_cluster": true
                    }
                ]
            }
        ],
        "enhanced_monitoring": "DEFAULT",
        "kafka_version": "3.2.0"
    }
}

解决方案 #

问题核心是没正确遍历嵌套数组层级：encryption_info和encryption_in_transit都是数组类型，必须逐层用[_]遍历元素；同时直接用contains判断整个对象的方式也不准确，要精准定位到client_broker字段的值。

正确的Rego规则如下：

# 当client_broker不是TLS时触发deny（规则不通过）
deny {
    r := tfplan.resource_changes[_]
    r.type == "aws_msk_cluster"
    # 遍历encryption_info数组中的每个元素
    encryption_info := r.change.after.encryption_info[_]
    # 遍历encryption_in_transit数组中的每个元素
    encryption_in_transit := encryption_info.encryption_in_transit[_]
    # 检查client_broker的值不等于TLS
    encryption_in_transit.client_broker != "TLS"
}

逻辑说明 #

1. 先定位resource_changes中所有类型为aws_msk_cluster的资源
2. 逐层遍历encryption_info和encryption_in_transit数组，拿到具体的client_broker字段值
3. 只要存在任意一个client_broker的值不是TLS，就触发deny规则（即规则不通过）；反之若所有client_broker都是TLS，deny不触发，规则通过

内容的提问来源于stack exchange，提问作者Samriddha Choudhuri