{"id":30182,"date":"2026-10-01T11:03:51","date_gmt":"2026-10-01T11:03:51","guid":{"rendered":"https:\/\/umang.pk\/2026\/10\/01\/%da%a9%d9%88%da%88-%d8%a7%d9%88%d8%b1-opa-%da%a9%db%92-%d8%a8%d8%b7%d9%88%d8%b1-%d9%be%d8%a7%d9%84%db%8c%d8%b3%db%8c%d9%88%da%ba-%da%a9%db%92-%d8%b3%d8%a7%d8%aa%da%be-ai-%d8%b3%db%92-%d8%aa%db%8c\/"},"modified":"2026-10-01T11:03:54","modified_gmt":"2026-10-01T11:03:54","slug":"%da%a9%d9%88%da%88-%d8%a7%d9%88%d8%b1-opa-%da%a9%db%92-%d8%a8%d8%b7%d9%88%d8%b1-%d9%be%d8%a7%d9%84%db%8c%d8%b3%db%8c%d9%88%da%ba-%da%a9%db%92-%d8%b3%d8%a7%d8%aa%da%be-ai-%d8%b3%db%92-%d8%aa%db%8c","status":"publish","type":"post","link":"https:\/\/umang.pk\/ur\/2026\/10\/01\/%da%a9%d9%88%da%88-%d8%a7%d9%88%d8%b1-opa-%da%a9%db%92-%d8%a8%d8%b7%d9%88%d8%b1-%d9%be%d8%a7%d9%84%db%8c%d8%b3%db%8c%d9%88%da%ba-%da%a9%db%92-%d8%b3%d8%a7%d8%aa%da%be-ai-%d8%b3%db%92-%d8%aa%db%8c\/","title":{"rendered":"\u06a9\u0648\u0688 \u0627\u0648\u0631 OPA \u06a9\u06d2 \u0628\u0637\u0648\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u06d2 \u0633\u0627\u062a\u06be AI \u0633\u06d2 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062f\u06c1 \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u06a9\u0627 \u0646\u0638\u0645 \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4 [Full Handbook]"},"content":{"rendered":"\n<div id=\"\">\n<p>\u062c\u062f\u06cc\u062f \u062a\u0631\u06cc\u0646 \u0645\u0627\u0688\u0644 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 100% \u0646\u062d\u0648\u06cc \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u0633\u062a \u06a9\u0648\u0688 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0648\u06cc\u0631\u0627 \u06a9\u0648\u0688 \u06a9\u06cc 2026 \u06a9\u06cc \u0631\u067e\u0648\u0631\u0679 \u0645\u06cc\u06ba \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u06a9\u06c1\u0627 \u06af\u06cc\u0627 \u06c1\u06d2 \u06a9\u06c1 &quot;\u0646\u062d\u0648 \u06a9\u0648 \u0645\u0624\u062b\u0631 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u062d\u0644 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4&#8221;<\/p>\n<p>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0633\u0646\u06af \u0645\u06cc\u0644 \u06a9\u06cc \u0637\u0631\u062d \u0644\u06af\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u06cc\u06c1\u0627\u06ba \u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0645\u0633\u0626\u0644\u06c1 \u06c1\u06d2.<\/p>\n<p>\u0627\u0633\u06cc \u0631\u067e\u0648\u0631\u0679 \u0645\u06cc\u06ba 100 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0645\u0627\u0688\u0644\u0632 \u06a9\u0627 \u062a\u062c\u0631\u0628\u06c1 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u0627\u0648\u0631 \u067e\u062a\u06c1 \u0686\u0644\u0627 \u06a9\u06c1 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u067e\u0627\u0633 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u0648\u0633\u0637 \u0634\u0631\u062d 56% \u062a\u06be\u06cc\u060c &quot;\u067e\u06c1\u0644\u06cc \u0631\u067e\u0648\u0631\u0679 \u0645\u06cc\u06ba 55% \u0633\u06d2 \u062a\u06be\u0648\u0691\u06cc \u062a\u0628\u062f\u06cc\u0644\u06cc&#8221; \u0627\u0648\u0631 \u06cc\u06c1 \u06a9\u06c1 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 44% \u062a\u062e\u0644\u06cc\u0642\u06cc \u0645\u0644\u0627\u0632\u0645\u062a\u0648\u06ba \u06a9\u06d2 \u0646\u062a\u06cc\u062c\u06d2 \u0645\u06cc\u06ba \u062e\u0637\u0631\u0646\u0627\u06a9 \u062e\u0637\u0631\u0627\u062a \u067e\u06cc\u062f\u0627 \u06c1\u0648\u0626\u06d2\u06d4<\/p>\n<p>\u0641\u0646\u06a9\u0634\u0646\u0644 \u062f\u0631\u0633\u062a\u06af\u06cc \u0627\u0648\u0631 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u0627\u0644\u06af \u0627\u0644\u06af \u0645\u0633\u0627\u0626\u0644 \u06c1\u06cc\u06ba\u060c \u062c\u0646 \u06a9\u06d2 \u062d\u0644 \u06c1\u0648\u0646\u06d2 \u06a9\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u06c1\u06d2\u06d4<\/p>\n<p>\u0646\u062a\u0627\u0626\u062c \u0646\u06c1 \u062a\u0648 \u0628\u0627\u06c1\u0631 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0646\u06c1 \u06c1\u06cc \u0646\u0626\u06d2\u06d4 2022 IEEE \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0627\u0648\u0631 \u0631\u0627\u0632\u062f\u0627\u0631\u06cc \u0645\u06cc\u06ba\u060c NYU \u0679\u0646\u0688\u0646 \u0679\u06cc\u0645 \u0646\u06d2 GitHub Copilot \u06a9\u0648 89 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0633\u06d2 \u0645\u062a\u0639\u0644\u0642\u06c1 \u0645\u0646\u0638\u0631\u0646\u0627\u0645\u0648\u06ba \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0686\u0644\u0627\u06cc\u0627\u060c 1,689 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0628\u0646\u0627\u0626\u06d2\u060c \u0627\u0648\u0631 \u067e\u062a\u06c1 \u0686\u0644\u0627 \u06a9\u06c1 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 40% MITER \u06a9\u06d2 CWE \u0679\u0627\u067e 25 \u0645\u06cc\u06ba \u0622\u0626\u0679\u0645\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062e\u0637\u0631\u06d2 \u0633\u06d2 \u062f\u0648\u0686\u0627\u0631 \u062a\u06be\u06d2\u06d4 <em>ACM \u06a9\u0645\u06cc\u0648\u0646\u06cc\u06a9\u06cc\u0634\u0646\u0632<\/em> \u062a\u062d\u0642\u06cc\u0642\u06cc \u062c\u06be\u0644\u06a9\u06cc\u0627\u06ba\u06d4<\/p>\n<p>\u0646\u0648\u0645\u0628\u0631 2024 \u0645\u06cc\u06ba\u060c \u062c\u0627\u0631\u062c \u0679\u0627\u0624\u0646 \u06a9\u06d2 \u0633\u06cc\u0646\u0679\u0631 \u0641\u0627\u0631 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0627\u06cc\u0646\u0688 \u0627\u06cc\u0645\u0631\u062c\u0646\u06af \u0679\u06cc\u06a9\u0646\u0627\u0644\u0648\u062c\u06cc\u0632 \u0646\u06d2 \u067e\u0627\u0646\u0686 LLMs \u06a9\u0627 \u062c\u0627\u0626\u0632\u06c1 \u0644\u06cc\u0627 \u0627\u0648\u0631 \u0628\u062a\u0627\u06cc\u0627 \u06a9\u06c1 \u0627\u0646 \u06a9\u06d2 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062f\u06c1 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0646\u0635\u0641 \u0679\u06a9\u0691\u0648\u06ba \u0645\u06cc\u06ba \u0627\u06cc\u0633\u06d2 \u06a9\u06cc\u0691\u06d2 \u0645\u0648\u062c\u0648\u062f \u06c1\u06cc\u06ba \u062c\u0648 \u0627\u0633\u062a\u062d\u0635\u0627\u0644 \u06a9\u0627 \u0628\u0627\u0639\u062b \u0628\u0646 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0686\u0627\u0631 \u0633\u0627\u0644\u060c \u0686\u0627\u0631 \u0622\u0632\u0627\u062f \u0679\u06cc\u0645\u06cc\u06ba\u060c \u0686\u0627\u0631 \u0637\u0631\u06cc\u0642\u06c1 \u06a9\u0627\u0631\u060c \u0627\u0648\u0631 \u06c1\u0631 \u0628\u0627\u0631 \u0627\u06cc\u06a9 \u06c1\u06cc \u062c\u0648\u0627\u0628\u06d4<\/p>\n<p>2023 ACM CCS \u0645\u06cc\u06ba\u060c \u0627\u0633\u0679\u06cc\u0646\u0641\u0648\u0631\u0688 \u06a9\u06d2 \u0646\u06cc\u0644 \u067e\u06cc\u0631\u06cc\u060c \u0645\u06cc\u06af\u06be\u0627 \u0633\u0631\u06cc\u0648\u0627\u0633\u062a\u0648\u060c \u062f\u06cc\u067e\u06a9 \u06a9\u0645\u0627\u0631\u060c \u0627\u0648\u0631 \u0688\u06cc\u0646 \u0628\u0648\u0646\u06d2 \u0646\u06d2 \u0627\u06cc\u06a9 \u062a\u062c\u0631\u0628\u06d2 \u0645\u06cc\u06ba \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u0648 \u0634\u0627\u0645\u0644 \u06a9\u06cc\u0627\u06d4 47 \u0634\u0631\u06a9\u0627\u0621 \u062a\u06be\u06d2\u060c 5 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u0633\u06d2 \u0645\u062a\u0639\u0644\u0642 \u067e\u0631\u0648\u06af\u0631\u0627\u0645\u0646\u06af \u0679\u0627\u0633\u06a9 \u06a9\u06d2 \u0633\u0627\u062a\u06be\u060c 3 \u0632\u0628\u0627\u0646\u06cc\u06ba\u060c 33 AI \u0645\u0639\u0627\u0648\u0646\u06cc\u0646 \u06a9\u06d2 \u0633\u0627\u062a\u06be\u060c \u0627\u0648\u0631 14 \u0628\u063a\u06cc\u0631\u06d4 \u062c\u0633 \u06af\u0631\u0648\u067e \u06a9\u0648 \u0645\u062f\u062f \u0645\u0644\u06cc \u0627\u0633 \u0646\u06d2 \u0628\u06c1\u062a \u06a9\u0645 \u0645\u062d\u0641\u0648\u0638 \u06a9\u0648\u0688 \u0644\u06a9\u06be\u0627 \u0627\u0648\u0631 <em>\u0645\u0632\u06cc\u062f<\/em> \u0648\u06c1 \u0627\u0633 \u0628\u0627\u062a \u067e\u0631 \u06cc\u0642\u06cc\u0646 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u0632\u06cc\u0627\u062f\u06c1 \u0627\u0645\u06a9\u0627\u0646 \u0631\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0648\u06c1 \u062c\u0648 \u06a9\u0648\u0688 \u0644\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u0648\u06c1 \u0645\u062d\u0641\u0648\u0638 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0686\u06be\u0648\u0679\u0627 \u0645\u0637\u0627\u0644\u0639\u06c1 \u06c1\u06d2 \u0627\u0648\u0631 \u06cc\u06c1 \u0628\u062a\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0645\u0633\u0626\u0644\u06c1 \u062e\u0648\u062f \u062d\u0644 \u06a9\u06cc\u0648\u06ba \u0646\u06c1\u06cc\u06ba \u06c1\u0648 \u0633\u06a9\u062a\u0627\u06d4 \u0639\u0627\u0645 \u0637\u0648\u0631 \u067e\u0631\u060c \u0648\u06c1 \u0637\u0631\u06cc\u0642\u06c1 \u06a9\u0627\u0631 \u062c\u0648 \u0627\u0633\u06d2 \u067e\u06a9\u0691\u062a\u0627 \u06c1\u06d2 (\u0627\u06af\u0631 \u0688\u0648\u06cc\u0644\u067e\u0631 \u0627\u0633 \u06a9\u0648\u0688 \u06a9\u06cc \u06af\u06c1\u0631\u0627\u0626\u06cc \u0645\u06cc\u06ba \u062f\u06cc\u06a9\u06be\u062a\u0627 \u06c1\u06d2 \u062c\u0633 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0648\u06c1 \u0641\u06a9\u0631 \u0645\u0646\u062f \u06c1\u06cc\u06ba) \u0648\u06c1\u06cc \u0639\u06cc\u0646 \u0637\u0631\u06cc\u0642\u06c1 \u06a9\u0627\u0631 \u06c1\u06d2 \u062c\u0648 \u0679\u0648\u0644 \u06a9\u0648 \u0628\u0646\u062f \u06a9\u0631 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u062a\u0645\u0627\u0645 \u0645\u0637\u0627\u0644\u0639\u0627\u062a \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0648\u0688 \u06a9\u06cc \u067e\u06cc\u0645\u0627\u0626\u0634 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062a\u0627\u06c1\u0645\u060c \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u06a9\u0648\u0688 \u0627\u06cc\u06a9 \u0632\u06cc\u0627\u062f\u06c1 \u0645\u0634\u06a9\u0644 \u0645\u0639\u0627\u0645\u0644\u06c1 \u06c1\u06d2\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0627\u06cc\u06a9 \u0628\u0631\u0627 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u06a9\u0628\u06be\u06cc \u0646\u0627\u06a9\u0627\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627\u06d4 \u06cc\u06c1 \u0628\u0627\u0644\u06a9\u0644 \u062a\u062d\u0631\u06cc\u0631\u06cc \u0637\u0648\u0631 \u067e\u0631 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0648 \u0628\u06be\u06cc \u067e\u0648\u0686\u06be\u062a\u0627 \u06c1\u06d2 \u0627\u0633\u06d2 \u0679\u0631\u06cc\u0641\u06a9 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0635\u0631\u0641 \u0648\u06c1\u06cc \u0686\u06cc\u0632 \u062c\u0648 \u0627\u0633\u06d2 \u0622\u067e \u06a9\u06d2 \u062e\u0644\u0627\u0641 \u067e\u06a9\u0691\u062a\u06cc \u06c1\u06d2 \u0648\u06c1 \u06c1\u06d2 \u062c\u0648 \u0622\u067e \u06a9\u0627 \u0641\u0631\u0642 \u067e\u0691\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u06cc\u06ba \u06a9\u062a\u0627\u0628 \u06a9\u0627 \u062c\u0627\u0626\u0632\u06c1 \u0646\u06c1\u06cc\u06ba \u0644\u06d2 \u0633\u06a9\u062a\u0627 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u0633\u06d2 \u067e\u0691\u06be \u0644\u06cc\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0646\u06c1 \u06c1\u06cc \u06a9\u0648\u0626\u06cc \u0627\u0648\u0631 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 \u0645\u06cc\u06ba \u06a9\u06cc\u0627 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u0648\u06ba \u0642\u0648\u0627\u0639\u062f \u06a9\u0648 \u0627\u06cc\u06a9 \u0641\u0627\u0631\u0645\u06cc\u0679 \u0645\u06cc\u06ba \u0644\u06a9\u06be\u062a\u0627 \u06c1\u0648\u06ba \u062c\u06c1\u0627\u06ba \u06a9\u0645\u067e\u06cc\u0648\u0679\u0631 \u062a\u0645\u0627\u0645 \u062a\u0628\u062f\u06cc\u0644\u06cc\u0648\u06ba \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u06d2 \u06af\u0627\u06d4 \u06a9\u0648\u0688 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0627 \u06cc\u06c1\u06cc \u0645\u0637\u0644\u0628 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u06c1\u06cc\u0646\u0688 \u0628\u06a9 \u0686\u06cc\u06a9 \u0644\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0639\u0645\u0644 \u0645\u06cc\u06ba \u0622\u067e \u06a9\u06cc \u0631\u06c1\u0646\u0645\u0627\u0626\u06cc \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4 \u06c1\u0645 \u0627\u0633\u06d2 \u0627\u0635\u0644 \u06a9\u0645\u0632\u0648\u0631 \u0630\u062e\u06cc\u0631\u06c1 \u0645\u06cc\u06ba \u062a\u0641\u0648\u06cc\u0636 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u06cc\u06a9 \u0648\u0627\u0636\u062d \u0648\u0631\u0698\u0646 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u0627\u0633 \u06a9\u06d2 \u0633\u0627\u0645\u0646\u06d2 \u0645\u0648\u062c\u0648\u062f 9 \u0645\u06cc\u06ba \u0633\u06d2 5 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0648\u06ba \u06a9\u0648 \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u067e\u06be\u0631 \u0627\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0622\u062e\u0631 \u0645\u06cc\u06ba\u060c \u0622\u067e \u06a9\u0648 \u0645\u0639\u0644\u0648\u0645 \u06c1\u0648 \u062c\u0627\u0626\u06d2 \u06af\u0627 \u06a9\u06c1 \u06a9\u06cc\u0633\u06d2:<\/p>\n<ul>\n<li>\n<p>JSON \u06a9\u0648 \u0631\u06cc\u06af\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0644\u06a9\u06be\u06cc\u06ba\u06d4 <code>terraform show -json<\/code> \u06c1\u0645 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0627\u067e\u0646\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u06cc\u06ba \u062c\u0633 \u0637\u0631\u062d \u0622\u067e \u0641\u06a9\u0633\u0686\u0631 \u0627\u0648\u0631 \u06a9\u0648\u0631\u06cc\u062c \u0631\u067e\u0648\u0631\u0679\u0633 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0627\u067e\u0646\u06d2 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u06a9\u0648\u0688 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>CI \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0627\u06cc\u06af\u0632\u0679 \u06a9\u0648\u0688 \u06a9\u0646\u0679\u0631\u06cc\u06a9\u0679\u0633 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u06a9\u0645\u0627\u0646\u0688 \u0644\u0627\u0626\u0646 \u06af\u06cc\u0679\u0633 \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>CEL \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 Kubernetes \u06a9\u06cc \u0645\u0646\u0638\u0648\u0631\u06cc \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u063a\u06cc\u0631 \u062a\u0639\u0645\u06cc\u0644 \u06a9\u0627\u0645 \u06a9\u06d2 \u0628\u0648\u062c\u06be \u06a9\u0648 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u0627\u0688\u0644 \u06a9\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0644\u06a9\u06be\u0646\u06d2 \u062f\u06cc\u06ba\u06d4 <code>opa check<\/code> \u0627\u0648\u0631 \u0622\u067e \u06a9\u06cc \u0627\u067e\u0646\u06cc \u062c\u0627\u0646\u0686 \u0627\u0633 \u0628\u0627\u062a \u06a9\u0627 \u062a\u0639\u06cc\u0646 \u06a9\u0631\u06d2 \u06af\u06cc \u06a9\u06c1 \u0622\u067e \u0627\u0633\u06d2 \u0631\u06a9\u06be\u06cc\u06ba \u06af\u06d2 \u06cc\u0627 \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0648\u06c1\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u0646\u062c\u0646 AI \u0627\u06cc\u062c\u0646\u0679\u0633 \u06a9\u06cc \u0679\u0648\u0644 \u06a9\u0627\u0644\u0632 \u06a9\u06cc \u0645\u0646\u0638\u0648\u0631\u06cc \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ul>\n<h2 id=\"heading-table-of-contents\">\u0627\u0646\u0688\u06cc\u06a9\u0633<\/h2>\n<h2 id=\"heading-prerequisites\">\u0634\u0631\u0637\u06cc\u06ba<\/h2>\n<p>\u0622\u067e \u06a9\u0648 \u062f\u0631\u062c \u0630\u06cc\u0644 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u06af\u06cc:<\/p>\n<ul>\n<li>\n<p>\u0679\u0631\u0645\u06cc\u0646\u0644\u0632 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06a9\u0627\u0645 \u06a9\u0631\u0646\u0627 <code>python3<\/code> (3.10 \u0627\u0648\u0631 \u0627\u0633 \u0633\u06d2 \u0627\u0648\u067e\u0631)\u06d4<\/p>\n<\/li>\n<li>\n<p><code>jq<\/code>\u06a9\u0645\u0627\u0646\u0688 \u0644\u0627\u0626\u0646 \u0633\u06d2 JSON \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062a\u0642\u0631\u06cc\u0628\u0627\u064b 700MB \u0688\u0633\u06a9 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 AWS Terraform \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0646\u0646\u062f\u06c1 \u0628\u0691\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>Anthropic API \u06a9\u0644\u06cc\u062f (\u0635\u0631\u0641 7 \u0645\u0631\u062d\u0644\u06c1)\u06d4 \u062f\u06cc\u06af\u0631 \u062a\u0645\u0627\u0645 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0622\u0641 \u0644\u0627\u0626\u0646 \u0686\u0644\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">mkdir policy-lab && cd policy-lab\npython3 -m venv .venv\nsource .venv\/bin\/activate\npip install anthropic\n\ncurl -L -o opa https:\/\/openpolicyagent.org\/downloads\/v1.20.2\/opa_darwin_arm64_static\nchmod +x opa && sudo mv opa \/usr\/local\/bin\/\n\ncurl -L -o tf.zip https:\/\/releases.hashicorp.com\/terraform\/1.14.2\/terraform_1.14.2_darwin_arm64.zip\nunzip tf.zip && sudo mv terraform \/usr\/local\/bin\/\n<\/code><\/pre>\n<p>\u0648\u0646\u0688\u0648\u0632 \u067e\u0631\u060c \u0622\u067e \u0645\u0627\u062d\u0648\u0644 \u06a9\u0648 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0686\u0627\u0644\u0648 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba: <code>.venvScriptsactivate<\/code>\u062f\u0648\u0646\u0648\u06ba \u0688\u0627\u0624\u0646 \u0644\u0648\u0688 \u06cc\u0648 \u0622\u0631 \u0627\u06cc\u0644 \u06a9\u0648 \u0627\u0633 \u0633\u06d2 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u06cc\u06ba: <code>opa_windows_amd64.exe<\/code> \u0627\u0648\u0631 <code>terraform_1.14.2_windows_amd64.zip<\/code>.<\/p>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 \u0646\u06cc\u0686\u06d2 \u0633\u0628 \u06a9\u0686\u06be \u0686\u0644\u0627\u06cc\u0627\u06d4 <strong>OPA 1.20.2<\/strong>\u060c <strong>\u0679\u06cc\u0631\u0627\u0641\u0627\u0631\u0645 1.14.2\u060c<\/strong> \u0627\u0648\u0631 <strong>AWS \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0646\u0646\u062f\u06c1 6.x<\/strong>macOS \u067e\u0631\u06d4 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u062d\u0648 OPA 1.x \u0645\u06cc\u06ba \u0645\u0633\u062a\u062d\u06a9\u0645 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u06af\u0631 \u0622\u067e OPA 0.x \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631 \u0631\u06c1\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u06cc\u06c1\u0627\u06ba \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u0627\u0635\u0648\u0644 \u062f\u0631\u06a9\u0627\u0631 \u06c1\u06cc\u06ba: <code>import rego.v1<\/code> \u0645\u06cc\u06ba \u0627\u0633\u06d2 \u0633\u0628 \u0633\u06d2 \u0627\u0648\u067e\u0631 \u0634\u0627\u0645\u0644 \u06a9\u0631\u0648\u06ba \u06af\u0627 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u067e \u06af\u0631\u06cc\u0688 \u06a9\u0631\u0648\u06ba \u06af\u0627\u06d4 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0648\u06ba \u06a9\u06cc \u062a\u0639\u062f\u0627\u062f AWS \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0646\u0646\u062f\u06c1 \u0648\u0631\u0698\u0646 \u067e\u0631 \u0645\u0646\u062d\u0635\u0631 \u06c1\u06d2\u060c \u062c\u0648 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0646\u0646\u062f\u06c1 5 \u0633\u06d2 \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u0645\u0633\u062a\u062d\u06a9\u0645 JSON \u067e\u0644\u0627\u0646 \u06a9\u06cc \u0634\u06a9\u0644 \u0645\u06cc\u06ba \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-key-terms-in-plain-english\">\u06a9\u0644\u06cc\u062f\u06cc \u0627\u0635\u0637\u0644\u0627\u062d\u0627\u062a \u0633\u0627\u062f\u06c1 \u0627\u0646\u06af\u0631\u06cc\u0632\u06cc \u0645\u06cc\u06ba<\/h2>\n<ul>\n<li>\n<p><strong>\u06a9\u0648\u0688 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc<\/strong>: \u0627\u06cc\u06a9 \u062a\u0646\u0638\u06cc\u0645 \u0645\u06cc\u06ba \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0642\u0648\u0627\u0639\u062f\u060c \u062c\u0648 \u06a9\u06c1 \u0645\u062c\u0648\u0632\u06c1 \u062a\u0628\u062f\u06cc\u0644\u06cc\u0648\u06ba \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u0641\u06cc\u0635\u0644\u06c1 \u0648\u0627\u067e\u0633 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0644\u06a9\u06be\u06d2 \u06af\u0626\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u0644\u06cc\u06af\u0648<\/strong>: \u0627\u0648\u067e\u0646 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u06cc\u062c\u0646\u0679 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06cc \u0632\u0628\u0627\u0646 \u06a9\u0627 \u062c\u0627\u0626\u0632\u06c1 \u0644\u06cc\u0627 \u06af\u06cc\u0627\u06d4 \u06cc\u06c1 \u0627\u0639\u0644\u0627\u0646\u06cc\u06c1 \u06c1\u06d2\u06d4 \u0627\u0635\u0648\u0644 \u0628\u0627\u0688\u06cc \u0634\u0631\u0627\u0626\u0637 \u06a9\u06cc \u0627\u06cc\u06a9 \u0641\u06c1\u0631\u0633\u062a \u06c1\u06d2 \u062c\u0648 \u0633\u0628 \u06a9\u0648 \u067e\u0648\u0631\u0627 \u06a9\u0631\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>JSON \u067e\u0644\u0627\u0646<\/strong>: \u0679\u06cc\u0631\u0627\u0641\u0627\u0631\u0645 \u06a9\u06cc\u0627 \u06a9\u0631\u06d2 \u06af\u0627 \u0627\u0633 \u06a9\u06cc \u0645\u0634\u06cc\u0646 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u062a\u0641\u0635\u06cc\u0644\u060c \u062c\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u062a\u06cc\u0627\u0631 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2: <code>terraform show -json<\/code>. \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06c1\u062a\u06cc \u06c1\u06d2: <code>.tf<\/code> \u0641\u0627\u0626\u0644 \u0646\u06c1\u06cc\u06ba \u0622\u062a\u06cc\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u062f\u0627\u062e\u0644\u06c1 \u06a9\u0646\u0679\u0631\u0648\u0644<\/strong>: Kubernetes API \u0633\u0631\u0648\u0631 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0627\u06cc\u06a9 \u0646\u0642\u0637\u06c1 \u062c\u06c1\u0627\u06ba \u06a9\u0633\u06cc \u0686\u06cc\u0632 \u06a9\u0648 \u0630\u062e\u06cc\u0631\u06c1 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0645\u0633\u062a\u0631\u062f \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u06a9\u06c1<\/strong>: \u06a9\u0627\u0645\u0646 \u0627\u06cc\u06a9\u0633\u067e\u0631\u06cc\u0634\u0646 \u0644\u06cc\u0646\u06af\u0648\u06cc\u062c\u060c \u0627\u06cc\u06a9 \u0686\u06be\u0648\u0679\u06cc \u0627\u06cc\u06a9\u0633\u067e\u0631\u06cc\u0634\u0646 \u0644\u06cc\u0646\u06af\u0648\u0626\u062c \u062c\u0633 \u06a9\u0627 \u0627\u0646\u062f\u0627\u0632\u06c1 Kubernetes \u0645\u0642\u0627\u0645\u06cc \u0637\u0648\u0631 \u067e\u0631 API \u0633\u0631\u0648\u0631 \u06a9\u06d2 \u0627\u0646\u062f\u0631\u060c \u0628\u063a\u06cc\u0631 \u06a9\u0633\u06cc \u0648\u06cc\u0628 \u06c1\u06a9\u0633 \u06a9\u06d2 \u062a\u0639\u06cc\u0646\u0627\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u062c\u06be\u0648\u0679\u06cc \u06a9\u0633\u0679\u0645 \u06a9\u0644\u06cc\u0626\u0631\u0646\u0633<\/strong>: \u0648\u06c1 \u0648\u0633\u0627\u0626\u0644 \u062c\u06c1\u0627\u06ba \u067e\u0627\u0644\u06cc\u0633\u06cc \u067e\u0627\u0633 \u06c1\u0648\u0626\u06cc \u0644\u06cc\u06a9\u0646 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648 \u062c\u0627\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2 \u062a\u06be\u06cc\u06d4 \u0622\u067e \u0627\u0633 \u06a9\u06cc \u067e\u06cc\u0645\u0627\u0626\u0634 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u0622\u067e \u0627\u0633\u06d2 \u062a\u0644\u0627\u0634 \u0646\u06c1 \u06a9\u0631\u06cc\u06ba \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0627\u0633\u06d2 \u0646\u0648\u0679\u0633 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ul>\n<p>\u0627\u06cc\u06a9 \u06c1\u06cc \u0641\u06cc\u0635\u0644\u06c1 \u062a\u06cc\u0646 \u062c\u06af\u06c1\u0648\u06ba \u067e\u0631 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u060c \u062c\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u062e\u0627\u0635 \u0637\u0648\u0631 \u067e\u0631 Kubernetes \u067e\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-step-1-fetch-real-infrastructure-to-test-against\">\u0645\u0631\u062d\u0644\u06c1 1: \u062c\u0627\u0646\u0686\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0635\u0644 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0688\u06be\u0627\u0646\u0686\u06c1 \u062d\u0627\u0635\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/h2>\n<p>\u0645\u06cc\u06ba \u06a9\u0645\u0632\u0648\u0631 Terraform \u0641\u0627\u0626\u0644\u0648\u06ba \u06a9\u0648 \u062a\u06cc\u0627\u0631 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u062a\u0627 \u062a\u06be\u0627\u06d4 \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0641\u0627\u0626\u0644\u0648\u06ba \u06a9\u0648 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06c1\u06d2 \u06a9\u06cc\u0691\u06d2 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u0646\u0627\u060c \u0627\u0648\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0635\u0631\u0641 \u06a9\u06cc\u0691\u06d2 \u067e\u06a9\u0691\u062a\u06cc \u06c1\u06cc\u06ba \u062c\u0648 \u0622\u067e \u0644\u06af\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0644\u06c1\u0630\u0627 \u0645\u06cc\u06ba \u0646\u06d2 \u062f\u0648\u0633\u0631\u0648\u06ba \u06a9\u06d2 \u0644\u06a9\u06be\u06d2 \u0627\u0648\u0631 \u0634\u0627\u0626\u0639 \u06a9\u0631\u062f\u06c1 \u06a9\u0648\u0688 \u06a9\u06cc \u062a\u0644\u0627\u0634 \u06a9\u06cc\u06d4<\/p>\n<p>TerraGoat \u0627\u06cc\u06a9 \u062c\u0627\u0646 \u0628\u0648\u062c\u06be \u06a9\u0631 \u06a9\u0645\u0632\u0648\u0631 Terraform \u0630\u062e\u06cc\u0631\u06c1 \u06c1\u06d2 \u062c\u0633\u06d2 Bridgecrew \u0646\u06d2 \u0634\u0627\u0626\u0639 \u06a9\u06cc\u0627 \u06c1\u06d2\u06d4 \u067e\u0646 \u06a9\u06cc \u06c1\u0648\u0626\u06cc \u06a9\u0645\u0679 \u0633\u06d2 EC2 \u0645\u0627\u0688\u06cc\u0648\u0644 \u062f\u0631\u0622\u0645\u062f \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">SHA=729f8da62c6a85ce4af5ad3d123de97776d954c4\ncurl -s \"https:\/\/raw.githubusercontent.com\/bridgecrewio\/terragoat\/$SHA\/terraform\/aws\/ec2.tf\" \n  | sed -n '77,96p'\n<\/code><\/pre>\n<pre><code class=\"language-hcl\">resource \"aws_security_group\" \"web-node\" {\n  # security group is open to the world in SSH port\n  name        = \"${local.resource_prefix.value}-sg\"\n  description = \"${local.resource_prefix.value} Security Group\"\n  vpc_id      = aws_vpc.web_vpc.id\n\n  ingress {\n    from_port = 80\n    to_port   = 80\n    protocol  = \"tcp\"\n    cidr_blocks = [\n    \"0.0.0.0\/0\"]\n  }\n  ingress {\n    from_port = 22\n    to_port   = 22\n    protocol  = \"tcp\"\n    cidr_blocks = [\n    \"0.0.0.0\/0\"]\n  }\n<\/code><\/pre>\n<p>\u062f\u0648\u0633\u0631\u06cc \u0644\u0627\u0626\u0646 \u067e\u0631 \u062a\u0628\u0635\u0631\u06c1 TerraGoat \u06a9\u0627 \u06c1\u06d2\u060c \u062c\u0648 \u067e\u0648\u0631\u0679 22 \u06a9\u06d2 \u062f\u0646\u06cc\u0627 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u06be\u0644\u06d2 \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u0637\u0631\u0641 \u0627\u0634\u0627\u0631\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>TerraGoat \u06a9\u06d2 \u0645\u0627\u0688\u06cc\u0648\u0644\u0632 \u062c\u062f\u06cc\u062f \u062a\u0631\u06cc\u0646 Terraform \u0645\u06cc\u06ba \u0634\u0631\u0648\u0639 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u06d2 \u06af\u0626\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u0627\u0628 \u0628\u06be\u06cc \u0627\u0639\u0644\u0627\u0646 \u06a9\u0631\u062a\u0627 \u06c1\u06d2: <code>type = \"string\"<\/code> Terraform 0.12 \u0645\u06cc\u06ba \u0641\u0631\u0633\u0648\u062f\u06c1 \u0627\u0648\u0631 1.x \u0645\u06cc\u06ba \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc\u0627 \u06af\u06cc\u0627\u06d4 \u0644\u06c1\u0630\u0627 \u0645\u06cc\u06ba \u0646\u06d2 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0627\u067e\u0646\u06d2 \u06a9\u0645 \u0633\u06d2 \u06a9\u0645 \u0645\u0627\u0688\u06cc\u0648\u0644 \u0645\u06cc\u06ba \u0644\u06c1\u0631\u0627\u06cc\u0627\u060c \u0635\u0631\u0641 \u062f\u0648 \u062d\u0648\u0627\u0644\u0648\u06ba \u06a9\u0648 TerraGoat \u06a9\u06d2 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0645\u0642\u0627\u0645\u06cc \u0644\u0648\u06af\u0648\u06ba \u06a9\u06cc \u062c\u06af\u06c1 \u0644\u06d2 \u06a9\u0631\u06d4<\/p>\n<p>\u0628\u0646\u0627\u0646\u0627 <code>main.tf<\/code>:<\/p>\n<pre><code class=\"language-hcl\">terraform {\n  required_version = \">= 1.9\"\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"\n      version = \"~> 6.0\"\n    }\n  }\n}\n\n# Mock credentials. This configuration is only ever planned, never applied,\n# so the provider must not try to reach AWS.\nprovider \"aws\" {\n  region                      = \"us-west-2\"\n  access_key                  = \"mock\"\n  secret_key                  = \"mock\"\n  skip_credentials_validation = true\n  skip_metadata_api_check     = true\n  skip_requesting_account_id  = true\n  skip_region_validation      = true\n}\n\nresource \"aws_vpc\" \"web_vpc\" {\n  cidr_block = \"10.0.0.0\/16\"\n}\n\n# Verbatim from bridgecrewio\/terragoat, terraform\/aws\/ec2.tf, commit 729f8da.\n# Only the two references to TerraGoat's own locals are replaced with literals.\nresource \"aws_security_group\" \"web-node\" {\n  name        = \"terragoat-sg\"\n  description = \"terragoat Security Group\"\n  vpc_id      = aws_vpc.web_vpc.id\n\n  ingress {\n    from_port = 80\n    to_port   = 80\n    protocol  = \"tcp\"\n    cidr_blocks = [\n    \"0.0.0.0\/0\"]\n  }\n  ingress {\n    from_port = 22\n    to_port   = 22\n    protocol  = \"tcp\"\n    cidr_blocks = [\n    \"0.0.0.0\/0\"]\n  }\n  egress {\n    from_port = 0\n    to_port   = 0\n    protocol  = \"-1\"\n    cidr_blocks = [\n    \"0.0.0.0\/0\"]\n  }\n  depends_on = [aws_vpc.web_vpc]\n  tags = {\n    git_commit           = \"d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0\"\n    git_file             = \"terraform\/aws\/ec2.tf\"\n    git_last_modified_at = \"2020-06-16 14:46:24\"\n    git_org              = \"bridgecrewio\"\n    git_repo             = \"terragoat\"\n  }\n}\n<\/code><\/pre>\n<p>\u067e\u0644\u0627\u0646 JSON \u0628\u0646\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">terraform init\nterraform plan -out=tfplan.binary\nterraform show -json tfplan.binary > plan.json\n<\/code><\/pre>\n<p>\u0641\u0631\u0636\u06cc \u0627\u0633\u0646\u0627\u062f \u0627\u06c1\u0645 \u06c1\u06cc\u06ba\u06d4 <code>terraform plan<\/code> \u0686\u0648\u0646\u06a9\u06c1 \u0635\u0631\u0641 \u062a\u062e\u0644\u06cc\u0642 \u06a9\u06cc \u062a\u0631\u062a\u06cc\u0628 AWS \u06a9\u0648 \u06a9\u0627\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u060c <code>skip_credentials_validation<\/code> \u0627\u0648\u0631 \u0648\u06c1 \u062a\u06cc\u0646 \u0628\u06c1\u0646 \u0628\u06be\u0627\u0626\u06cc \u062c\u0646 \u06a9\u06cc \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0646\u0646\u062f\u06c1 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u06a9\u0648\u0634\u0634 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u0686\u06be \u0628\u06be\u06cc \u0644\u0627\u06af\u0648 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-step-2-write-the-tests-before-the-policy\">\u0645\u0631\u062d\u0644\u06c1 2: \u067e\u0627\u0644\u06cc\u0633\u06cc \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0679\u06cc\u0633\u0679 \u0644\u06a9\u06be\u06cc\u06ba\u06d4<\/h2>\n<p>\u0645\u06cc\u06ba \u062c\u0648 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0686\u0627\u06c1\u062a\u0627 \u06c1\u0648\u06ba \u0648\u06c1 \u06c1\u06cc\u06ba: <em>\u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u0627\u067e\u0646\u06d2 \u0627\u0646\u062a\u0638\u0627\u0645\u06cc \u0628\u0646\u062f\u0631\u06af\u0627\u06c1 \u06a9\u0648 \u0639\u0648\u0627\u0645\u06cc \u0627\u0646\u0679\u0631\u0646\u06cc\u0679 \u067e\u0631 \u0628\u06d2 \u0646\u0642\u0627\u0628 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u0627\u06d4<\/em><\/p>\n<p>\u06cc\u06c1 \u06a9\u0648\u0688 \u06a9\u06cc \u0627\u06cc\u06a9 \u0644\u0627\u0626\u0646 \u06a9\u06cc \u0637\u0631\u062d \u0644\u06af\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u062c\u0627\u0646\u0686 \u0633\u06d2 \u067e\u062a\u06c1 \u0686\u0644\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0627\u06cc\u0633\u0627 \u06a9\u06cc\u0648\u06ba \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0628\u0646\u0627\u0646\u0627 <code>policy\/network_test.rego<\/code>:<\/p>\n<pre><code class=\"language-rego\">package terraform.network_test\n\nimport data.terraform.network\n\nplan(resources) := {\"resource_changes\": resources}\n\nsecurity_group(ingress) := {\n\t\"address\": \"aws_security_group.web\",\n\t\"type\": \"aws_security_group\",\n\t\"change\": {\"actions\": [\"create\"], \"after\": {\"ingress\": [ingress]}},\n}\n\ntest_denies_ssh_open_to_the_world if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 22,\n\t\t\"to_port\": 22,\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t})])\n\n\tcount(network.deny) == 1 with input as fixture\n}\n\n# A from_port equality check would miss this. The range check does not.\ntest_denies_wide_open_port_range if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 0,\n\t\t\"to_port\": 65535,\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t})])\n\n\tcount(network.deny) == 4 with input as fixture\n}\n\ntest_denies_ipv6_route_to_the_world if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 22,\n\t\t\"to_port\": 22,\n\t\t\"protocol\": \"tcp\",\n\t\t\"ipv6_cidr_blocks\": [\"::\/0\"],\n\t})])\n\n\tcount(network.deny) == 1 with input as fixture\n}\n\ntest_denies_standalone_ingress_rule if {\n\tfixture := plan([{\n\t\t\"address\": \"aws_vpc_security_group_ingress_rule.ssh\",\n\t\t\"type\": \"aws_vpc_security_group_ingress_rule\",\n\t\t\"change\": {\"actions\": [\"create\"], \"after\": {\n\t\t\t\"from_port\": 22,\n\t\t\t\"to_port\": 22,\n\t\t\t\"ip_protocol\": \"tcp\",\n\t\t\t\"cidr_ipv4\": \"0.0.0.0\/0\",\n\t\t\t\"cidr_ipv6\": null,\n\t\t}},\n\t}])\n\n\tcount(network.deny) == 1 with input as fixture\n}\n\ntest_denies_deprecated_standalone_rule if {\n\tfixture := plan([{\n\t\t\"address\": \"aws_security_group_rule.ssh\",\n\t\t\"type\": \"aws_security_group_rule\",\n\t\t\"change\": {\"actions\": [\"create\"], \"after\": {\n\t\t\t\"type\": \"ingress\",\n\t\t\t\"from_port\": 22,\n\t\t\t\"to_port\": 22,\n\t\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t\t}},\n\t}])\n\n\tcount(network.deny) == 1 with input as fixture\n}\n\ntest_allows_ssh_from_a_private_range if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 22,\n\t\t\"to_port\": 22,\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"10.0.0.0\/8\"],\n\t})])\n\n\tcount(network.deny) == 0 with input as fixture\n}\n\ntest_allows_https_from_the_world if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 443,\n\t\t\"to_port\": 443,\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t})])\n\n\tcount(network.deny) == 0 with input as fixture\n}\n\n# An all-protocols rule opens every port, whatever its port fields say.\n# The first version of this test asserted the opposite and hid the bug.\ntest_denies_all_protocols_rule_open_to_the_world if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 0,\n\t\t\"to_port\": 0,\n\t\t\"protocol\": \"-1\",\n\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t})])\n\n\tcount(network.deny) == 4 with input as fixture\n}\n\n# Ports the policy cannot read are reported, never passed.\ntest_reports_a_world_open_rule_with_unreadable_ports if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 22,\n\t\t\"to_port\": null,\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t})])\n\n\tcount(network.deny) == 1 with input as fixture\n}\n\ntest_reports_string_ports if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": \"22\",\n\t\t\"to_port\": \"22\",\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"0.0.0.0\/0\"],\n\t})])\n\n\tcount(network.deny) == 1 with input as fixture\n}\n\n# Unreadable ports on a rule that is not open to the world stay quiet.\ntest_ignores_unreadable_ports_on_a_private_range if {\n\tfixture := plan([security_group({\n\t\t\"from_port\": 22,\n\t\t\"to_port\": null,\n\t\t\"protocol\": \"tcp\",\n\t\t\"cidr_blocks\": [\"10.0.0.0\/8\"],\n\t})])\n\n\tcount(network.deny) == 0 with input as fixture\n}\n\n# `considered` drives the gate's pass-or-vacuous decision, so it needs\n# tests of its own even though it takes no part in the judgement.\ntest_considers_every_ingress_bearing_type if {\n\tfixture := plan([\n\t\tsecurity_group({}),\n\t\t{\"address\": \"aws_vpc_security_group_ingress_rule.a\", \"type\": \"aws_vpc_security_group_ingress_rule\", \"change\": {\"actions\": [\"create\"], \"after\": {}}},\n\t\t{\"address\": \"aws_security_group_rule.b\", \"type\": \"aws_security_group_rule\", \"change\": {\"actions\": [\"create\"], \"after\": {}}},\n\t])\n\n\tcount(network.considered) == 3 with input as fixture\n}\n\ntest_does_not_consider_unrelated_types if {\n\tfixture := plan([{\n\t\t\"address\": \"aws_vpc.main\",\n\t\t\"type\": \"aws_vpc\",\n\t\t\"change\": {\"actions\": [\"create\"], \"after\": {}},\n\t}])\n\n\tcount(network.considered) == 0 with input as fixture\n}\n<\/code><\/pre>\n<p>\u06cc\u06c1 \u06c1\u06d2 \u0648\u06c1 \u0641\u0627\u0626\u0644 \u062c\u0648 \u0627\u0646\u06a9\u0648\u0688 \u06a9\u0631\u062a\u06cc \u06c1\u06d2:<\/p>\n<ol>\n<li>\n<p><code>with input as fixture<\/code>    \u062c\u0639\u0644\u06cc \u067e\u0644\u0627\u0646 \u06a9\u0648 \u0627\u06cc\u06a9 \u06c1\u06cc \u0627\u0638\u06c1\u0627\u0631 \u0633\u06d2 \u0628\u062f\u0644 \u062f\u06cc\u06ba\u06d4 \u06cc\u06c1 \u06a9\u0644\u0627\u0624\u0688 \u0627\u06a9\u0627\u0624\u0646\u0679 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u067e\u0646\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u062c\u0627\u0646\u0686\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0637\u0631\u06cc\u0642\u06c1 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><code>test_denies_wide_open_port_range<\/code>    \u0645\u06cc\u06ba \u0627\u0633 \u06a9\u0627 \u0645\u0646\u062a\u0638\u0631 \u06c1\u0648\u06ba\u06d4 <strong>\u06c1\u0627\u06ba<\/strong> \u0641\u06cc \u0645\u0646\u06cc\u062c\u0645\u0646\u0679 \u067e\u0648\u0631\u0679 \u067e\u0631 \u0627\u06cc\u06a9 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u062f\u0627\u062e\u0644\u06d2 \u06a9\u06d2 \u0642\u0648\u0627\u0639\u062f \u062f\u0627\u0626\u0631\u06c1 \u06a9\u0627\u0631 \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06a9\u0648\u0626\u06cc \u0631\u0627\u0633\u062a\u06c1 \u0646\u06c1\u06cc\u06ba <code>0-65535<\/code> \u06cc\u06c1 \u0642\u0627\u0639\u062f\u06c1 SSH \u06a9\u0648 \u0628\u0627\u0644\u06a9\u0644 \u0648\u0627\u0636\u062d \u067e\u0648\u0631\u0679 22 \u0627\u0635\u0648\u0644 \u06a9\u06cc \u0637\u0631\u062d \u06a9\u06be\u0648\u0644\u062a\u0627 \u06c1\u06d2\u060c \u0645\u0633\u0627\u0648\u0627\u062a \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0648 \u067e\u0627\u0633 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062a\u06cc\u0646 \u0679\u06cc\u0633\u0679 \u062a\u06cc\u0646 \u0686\u06cc\u0632\u0648\u06ba \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba: <em>\u0645\u062e\u062a\u0644\u0641<\/em> \u0627\u06cc\u06a9 \u0646\u0638\u0631 \u062c\u0633\u06d2 Terraform \u0627\u0633\u06cc \u062e\u06cc\u0627\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2: IPv6 \u0641\u06cc\u0644\u0688\u060c \u062c\u062f\u06cc\u062f \u0627\u0633\u0679\u06cc\u0646\u0688\u06d4 <code>aws_vpc_security_group_ingress_rule<\/code>\u0627\u0648\u0631 \u0641\u0631\u0633\u0648\u062f\u06c1 <code>aws_security_group_rule<\/code>. \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u0627\u060c \u0627\u0648\u0631 \u0645\u06cc\u06ba \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u0627 \u06c1\u0648\u06ba \u06a9\u06c1 \u06cc\u06c1 \u0645\u0631\u062d\u0644\u06c1 9 \u0645\u06cc\u06ba \u06a9\u06c1\u0627\u06ba \u0633\u06d2 \u0622\u06cc\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062f\u0648 <code>test_allows_<\/code> \u06a9\u06cc\u0633 \u0627\u062a\u0646\u0627 \u06c1\u06cc \u0627\u06c1\u0645 \u06c1\u06d2 \u062c\u062a\u0646\u0627 \u06a9\u06c1 \u0631\u062f \u06a9\u0631\u0646\u0627\u06d4 \u0627\u06cc\u0633\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u062c\u0648 \u06c1\u0631 \u0686\u06cc\u0632 \u0633\u06d2 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u0628\u06cc\u06a9\u0627\u0631 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u0627\u0645\u062a\u062d\u0627\u0646\u0627\u062a \u0633\u06d2 \u06af\u0632\u0631\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0622\u062e\u0631\u06cc \u062a\u06cc\u0646 \u0679\u06cc\u0633\u0679 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06d2 \u067e\u06c1\u0644\u06d2 \u06c1\u06cc &quot;\u06c1\u0648\u0646\u06d2&#8221; \u06a9\u06d2 \u0628\u0639\u062f \u0622\u0626\u06d2 \u0627\u0648\u0631 \u0645\u0631\u062d\u0644\u06c1 9 \u0628\u062a\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0648\u06c1 \u06a9\u06c1\u0627\u06ba \u0633\u06d2 \u0622\u0626\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062a\u0645\u0627\u0645 \u067e\u0631\u0648\u0679\u0648\u06a9\u0648\u0644 \u0642\u0648\u0627\u0639\u062f \u06a9\u0648 \u067e\u0648\u0631\u0679 \u0641\u06cc\u0644\u0688 \u0645\u06cc\u06ba \u0645\u062a\u0639\u06cc\u0646 \u062a\u0645\u0627\u0645 \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u0648\u06ba \u06a9\u0648 \u06a9\u06be\u0648\u0644\u0646\u0627 \u0686\u0627\u06c1\u0626\u06d2\u060c \u0627\u0648\u0631 \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u0648\u06ba \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0642\u0648\u0627\u0639\u062f \u062c\u0646 \u06a9\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u06c1\u06cc\u06ba \u067e\u0691\u06be \u0633\u06a9\u062a\u06cc \u06c1\u06d2 \u0627\u0633 \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc \u062c\u0627\u0646\u06cc \u0686\u0627\u06c1\u0626\u06d2\u06d4<\/p>\n<\/li>\n<\/ol>\n<h2 id=\"heading-step-3-write-the-policy-until-the-tests-pass\">\u0645\u0631\u062d\u0644\u06c1 3: \u0679\u06cc\u0633\u0679 \u067e\u0627\u0633 \u06c1\u0648\u0646\u06d2 \u062a\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0628\u0646\u0627\u0626\u06cc\u06ba<\/h2>\n<p>Terraform \u0686\u0627\u0631 \u0634\u06a9\u0644\u0648\u06ba \u0645\u06cc\u06ba \u062f\u0627\u062e\u0644 \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0686\u0627\u0631\u0648\u06ba \u06a9\u0648 \u0627\u06cc\u06a9 \u0633\u06cc\u0679 \u0645\u06cc\u06ba \u0645\u0639\u0645\u0648\u0644 \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u067e\u06be\u0631 \u0641\u06cc\u0635\u0644\u06c1 \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u0633\u06cc\u0679 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0628\u0646\u0627\u0646\u0627 <code>policy\/network.rego<\/code>:<\/p>\n<pre><code class=\"language-rego\"># METADATA\n# title: No admin port is reachable from the public internet\n# description: |\n#   Terraform describes ingress in four different shapes. Each one is\n#   normalised into a single `exposures` set first, so the judgement below\n#   is written once and a new shape only costs one more helper rule.\n#\n#   Two things here are deliberate rather than incidental. An all-protocols\n#   rule covers every port whatever its port fields say, and a rule whose\n#   ports this policy cannot read is reported rather than passed.\npackage terraform.network\n\nadmin_ports := {22, 3389, 3306, 5432}\n\npublic_cidrs := {\"0.0.0.0\/0\", \"::\/0\"}\n\n# The AWS provider writes from_port 0 and to_port 0 for an all-protocols\n# rule, which opens every port, so the port fields cannot be read literally.\nall_protocols := {\"-1\", \"all\"}\n\n# Shape 1 and 2: inline ingress blocks, IPv4 and IPv6.\nexposures contains exposure if {\n\tsome resource in input.resource_changes\n\tresource.type == \"aws_security_group\"\n\tsome ingress in resource.change.after.ingress\n\tsome field in [\"cidr_blocks\", \"ipv6_cidr_blocks\"]\n\tsome cidr in object.get(ingress, field, [])\n\texposure := {\n\t\t\"address\": resource.address,\n\t\t\"protocol\": object.get(ingress, \"protocol\", \"\"),\n\t\t\"from_port\": object.get(ingress, \"from_port\", null),\n\t\t\"to_port\": object.get(ingress, \"to_port\", null),\n\t\t\"cidr\": cidr,\n\t}\n}\n\n# Shape 3: the standalone rule the AWS provider has recommended since v5.\nexposures contains exposure if {\n\tsome resource in input.resource_changes\n\tresource.type == \"aws_vpc_security_group_ingress_rule\"\n\tsome field in [\"cidr_ipv4\", \"cidr_ipv6\"]\n\tcidr := object.get(resource.change.after, field, null)\n\tis_string(cidr)\n\texposure := {\n\t\t\"address\": resource.address,\n\t\t\"protocol\": object.get(resource.change.after, \"ip_protocol\", \"\"),\n\t\t\"from_port\": object.get(resource.change.after, \"from_port\", null),\n\t\t\"to_port\": object.get(resource.change.after, \"to_port\", null),\n\t\t\"cidr\": cidr,\n\t}\n}\n\n# Shape 4: the deprecated standalone rule, still in most existing estates.\nexposures contains exposure if {\n\tsome resource in input.resource_changes\n\tresource.type == \"aws_security_group_rule\"\n\tresource.change.after.type == \"ingress\"\n\tsome cidr in object.get(resource.change.after, \"cidr_blocks\", [])\n\texposure := {\n\t\t\"address\": resource.address,\n\t\t\"protocol\": object.get(resource.change.after, \"protocol\", \"\"),\n\t\t\"from_port\": object.get(resource.change.after, \"from_port\", null),\n\t\t\"to_port\": object.get(resource.change.after, \"to_port\", null),\n\t\t\"cidr\": cidr,\n\t}\n}\n\n# The ports a rule really covers. Undefined when the policy cannot tell.\ncovered_ports(exposure) := [0, 65535] if {\n\texposure.protocol in all_protocols\n}\n\ncovered_ports(exposure) := [exposure.from_port, exposure.to_port] if {\n\tnot exposure.protocol in all_protocols\n\tis_number(exposure.from_port)\n\tis_number(exposure.to_port)\n}\n\ndeny contains msg if {\n\tsome exposure in exposures\n\texposure.cidr in public_cidrs\n\n\t# A rule covers a port if that port falls inside [from_port, to_port].\n\trange := covered_ports(exposure)\n\tsome port in admin_ports\n\tport >= range[0]\n\tport <= range[1]\n\n\tmsg := sprintf(\n\t\t\"%s: ingress rule exposes port %d to %s\",\n\t\t[exposure.address, port, exposure.cidr],\n\t)\n}\n\n# A rule open to the world whose ports this policy cannot read is reported.\n# Passing it would be the policy guessing in the permissive direction.\ndeny contains msg if {\n\tsome exposure in exposures\n\texposure.cidr in public_cidrs\n\tnot covered_ports(exposure)\n\n\tmsg := sprintf(\n\t\t\"%s: ingress rule to %s has ports this policy cannot evaluate (%v to %v)\",\n\t\t[exposure.address, exposure.cidr, exposure.from_port, exposure.to_port],\n\t)\n}\n\n# Addresses this policy knows how to inspect. The gate uses this to tell\n# \"nothing violated\" apart from \"nothing examined\".\nconsidered contains resource.address if {\n\tsome resource in input.resource_changes\n\tresource.type in {\n\t\t\"aws_security_group\",\n\t\t\"aws_vpc_security_group_ingress_rule\",\n\t\t\"aws_security_group_rule\",\n\t}\n}\n<\/code><\/pre>\n<p>\u0627\u0648\u067e\u0631 \u0633\u06d2 \u067e\u0691\u06be\u0646\u0627:<\/p>\n<ol>\n<li>\n<p>\u0631\u06cc\u06af\u0648 \u06a9\u06d2 \u0642\u0648\u0627\u0639\u062f \u06a9\u0627 \u0628\u0627\u0688\u06cc \u0627\u06cc\u06a9 \u06a9\u0646\u06a9\u0634\u0646 \u06c1\u06d2\u06d4 \u062a\u0645\u0627\u0645 \u0644\u0627\u0626\u0646\u0648\u06ba \u06a9\u0648 \u0628\u0631\u0642\u0631\u0627\u0631 \u0631\u06a9\u06be\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u060c <code>some ... in<\/code> \u0686\u0648\u0646\u06a9\u06c1 \u0644\u0627\u0626\u0646\u06cc\u06ba \u062f\u06c1\u0631\u0627\u0626\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0648 \u067e\u06cc \u0627\u06d2 \u0648\u0633\u0627\u0626\u0644 \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u0645\u062c\u0645\u0648\u0639\u0648\u06ba\u060c \u062f\u0627\u062e\u0644\u06cc \u0642\u0648\u0627\u0646\u06cc\u0646\u060c \u0641\u06cc\u0644\u0688\u0632 \u0627\u0648\u0631 \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u0648\u06ba \u06a9\u0648 \u062a\u0644\u0627\u0634 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>3 \u0627\u0644\u06af <code>exposures<\/code> \u0642\u0648\u0627\u0639\u062f \u0627\u0646 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0627\u06cc\u06a9 \u0633\u06cc\u0679 \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062c\u0633\u06d2 \u0631\u06cc\u06af\u0648 \u0627\u06cc\u06a9 \u0627\u0636\u0627\u0641\u06cc \u062a\u0639\u0631\u06cc\u0641 \u06a9\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u06af\u0631 \u0622\u067e \u0628\u0639\u062f \u0645\u06cc\u06ba \u067e\u0627\u0646\u0686\u0648\u06cc\u06ba \u0634\u06a9\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u0622\u067e \u0627\u06cc\u06a9 \u0627\u0648\u0631 \u0628\u0644\u0627\u06a9 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba \u06af\u06d2 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u0646\u06cc\u0686\u06d2 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u0628\u062f\u0644\u06d2 \u06af\u0627\u06d4<\/p>\n<\/li>\n<li>\n<p><code>object.get(ingress, field, [])<\/code>    \u0627\u06af\u0631 \u0641\u06cc\u0644\u0688 \u063a\u0627\u0626\u0628 \u06c1\u06d2\u060c \u062a\u0648 \u06cc\u06c1 \u0627\u06cc\u06a9 \u062e\u0627\u0644\u06cc \u0641\u06c1\u0631\u0633\u062a \u0644\u0648\u0679\u0627\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u0635\u0631\u0641 IPv4 \u06a9\u06d2 \u0627\u0635\u0648\u0644 \u0627\u0633 \u0648\u0642\u062a \u063a\u0644\u0637\u06cc \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u06cc\u06ba \u06af\u06d2 \u062c\u0628 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u0633 \u06a9\u06cc \u062a\u0644\u0627\u0634 \u06a9\u0631\u06d2 \u06af\u06cc: <code>ipv6_cidr_blocks<\/code>.<\/p>\n<\/li>\n<li>\n<p><code>covered_ports<\/code>    \u06cc\u06c1 \u06cc\u06c1\u0627\u06ba \u0627\u06cc\u06a9 \u062d\u0641\u0627\u0638\u062a\u06cc \u0648\u0627\u0644\u0648 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u062a\u0645\u0627\u0645 \u067e\u0631\u0648\u0679\u0648\u06a9\u0648\u0644 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0627\u0633 \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>0<\/code> \u06a9\u0648 <code>0<\/code> \u0686\u0648\u0646\u06a9\u06c1 \u062a\u0645\u0627\u0645 \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u06cc\u06ba \u06a9\u06be\u0644\u062a\u06d2 \u0648\u0642\u062a \u067e\u0644\u0627\u0646 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u067e\u0648\u0631\u0679 \u0641\u06cc\u0644\u0688 \u06a9\u0648 \u0644\u0641\u0638\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0646\u06c1\u06cc\u06ba \u067e\u0691\u06be\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u062c\u06c1\u0627\u06ba \u067e\u0648\u0631\u0679 null \u06c1\u0648 \u06cc\u0627 \u0633\u0679\u0631\u0646\u06af \u0641\u0646\u06a9\u0634\u0646 \u06a9\u0648 \u063a\u06cc\u0631 \u0645\u062a\u0639\u06cc\u0646\u06c1 \u0686\u06be\u0648\u0691 \u062f\u06cc\u062a\u06cc \u06c1\u06d2\u06d4 <code>deny<\/code> \u0642\u0648\u0627\u0646\u06cc\u0646 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0648\u06ba \u0645\u06cc\u06ba \u0628\u062f\u0644 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><code>considered<\/code>    \u06cc\u06c1 \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u0627 \u062d\u0635\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0631\u06cc\u06a9\u0627\u0631\u0688 \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0648\u06c1 \u06a9\u0646 \u0648\u0633\u0627\u0626\u0644 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0628\u0627\u062a \u06a9\u0631 \u0633\u06a9\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0648\u06c1 \u06a9\u0648\u0646 \u0633\u06d2 \u0648\u0633\u0627\u0626\u0644 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u062c\u0648 \u0645\u0631\u062d\u0644\u06c1 5 \u0645\u06cc\u06ba \u063a\u06cc\u0631 \u062d\u0627\u0635\u0644 \u0634\u062f\u06c1 \u067e\u0627\u0633\u0648\u06ba \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u0646\u06d2 \u0633\u06d2 \u0628\u0686\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ol>\n<p>\u0686\u0644\u0627\u0626\u06cc\u06ba:<\/p>\n<pre><code class=\"language-bash\">opa test policy\nopa check --strict policy\nopa fmt --diff policy\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">PASS: 20\/20\n<\/code><\/pre>\n<p>\u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba <code>-v<\/code> \u06a9\u0648 <code>opa test<\/code> \u0627\u06cc\u06a9 \u0644\u0627\u0626\u0646 \u0641\u06cc \u0679\u06cc\u0633\u0679\u06d4<\/p>\n<p><code>opa check --strict<\/code>    \u062c\u0628\u06a9\u06c1 \u06cc\u06c1 \u063a\u06cc\u0631 \u0645\u062d\u0641\u0648\u0638 \u0645\u062a\u063a\u06cc\u0631\u0627\u062a \u0627\u0648\u0631 \u067e\u0648\u0634\u06cc\u062f\u06c1 \u062f\u0631\u0622\u0645\u062f\u0627\u062a \u06a9\u0648 \u067e\u06a9\u0691\u062a\u0627 \u06c1\u06d2\u06d4 <code>opa fmt --diff<\/code> \u0627\u06af\u0631 \u0641\u0627\u0631\u0645\u06cc\u0679 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u06c1\u06cc \u0645\u0639\u06cc\u0627\u0631\u06cc \u06c1\u06d2 \u062a\u0648 \u06a9\u0686\u06be \u0628\u06be\u06cc \u067e\u0631\u0646\u0679 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2 \u06af\u0627\u06d4 OPA \u0641\u0627\u0631\u0645\u06cc\u0679 \u0631\u06cc\u06af\u0648 \u06a9\u0648 \u0628\u0637\u0648\u0631 \u0679\u06cc\u0628\u0632\u06d4 \u06c1\u0631 \u0686\u06cc\u0632 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u062f\u0648\u0646\u0648\u06ba \u06a9\u0627 \u062a\u0639\u0644\u0642 CI \u0633\u06d2 \u06c1\u06d2\u06d4<\/p>\n<p>\u062f\u0648\u0633\u0631\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u0645\u0644\u06a9\u06cc\u062a \u06a9\u06cc \u0679\u06cc\u06af\u0646\u06af \u06c1\u06d2\u060c \u062a\u0648 <code>policy\/tags.rego<\/code>:<\/p>\n<pre><code class=\"language-rego\"># METADATA\n# title: Every managed resource carries ownership tags\n# description: |\n#   Terraform emits `tags: null` for a resource with no tags at all, so a\n#   policy that reaches into `after.tags` skips exactly the resources with\n#   the worst tagging. `tags_of` coerces that null to an empty object.\npackage terraform.tags\n\nrequired_tags := {\"owner\", \"cost-center\", \"data-classification\"}\n\n# Resource types that genuinely cannot carry tags.\nuntaggable := {\"aws_iam_policy_attachment\", \"aws_route_table_association\"}\n\nin_scope contains resource if {\n\tsome resource in input.resource_changes\n\tsome action in resource.change.actions\n\taction in {\"create\", \"update\"}\n\tnot resource.type in untaggable\n}\n\ntags_of(resource) := tags if {\n\ttags := resource.change.after.tags\n\tis_object(tags)\n} else := {}\n\ndeny contains msg if {\n\tsome resource in in_scope\n\tsome tag in required_tags\n\tvalue := object.get(tags_of(resource), tag, \"\")\n\ttrim_space(value) == \"\"\n\tmsg := sprintf(\"%s: missing required tag %q\", [resource.address, tag])\n}\n\nconsidered contains resource.address if {\n\tsome resource in in_scope\n}\n<\/code><\/pre>\n<p>\u06cc\u06c1\u0627\u06ba \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u062f\u0648 \u0644\u0627\u0626\u0646\u06cc\u06ba \u0627\u0633 \u0637\u0631\u062d \u06a9\u06cc\u0648\u06ba \u0646\u0638\u0631 \u0622\u062a\u06cc \u06c1\u06cc\u06ba:<\/p>\n<ol>\n<li>\n<p><code>trim_space(value) == \"\"<\/code>    \u0686\u06cc\u06a9 \u06a9\u0631\u0648\u06d4 \u0627\u06cc\u0633\u0627 \u06c1\u06cc \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u0635\u0631\u0641 \u0631\u06cc\u06af\u0648 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06c1\u06cc \u0645\u0645\u06a9\u0646 \u06c1\u06d2\u06d4 <code>false<\/code> undefined \u063a\u0644\u0637 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0627\u06cc\u06a9 \u062e\u0627\u0644\u06cc \u062a\u0627\u0631 \u0633\u0686 \u06c1\u06d2\u06d4 \u0628\u06d2 \u0646\u0642\u0627\u0628 \u0648\u062c\u0648\u062f \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0622\u0633\u0627\u0646\u06cc \u0633\u06d2 \u0642\u0628\u0648\u0644 \u06a9\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 <code>owner = \"\"<\/code>\u06cc\u06c1 \u062a\u0639\u0645\u06cc\u0644 \u062a\u06be\u06cc\u0679\u0631 \u06a9\u06cc \u0642\u0633\u0645 \u06c1\u06d2 \u062c\u0633\u06d2 \u0631\u0648\u06a9\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0679\u06cc\u06af \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0645\u0648\u062c\u0648\u062f \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><code>tags_of<\/code>\u0627\u0633 \u06a9\u0627 <code>else := {}<\/code> \u0628\u0631\u0627\u0646\u0686 \u0627\u06cc\u06a9 \u0628\u06af \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0641\u06a9\u0633 \u06c1\u06d2 \u062c\u0648 \u0645\u06cc\u06ba \u0646\u06d2 \u0644\u06a9\u06be\u0627 \u062a\u06be\u0627 \u0627\u0648\u0631 \u0635\u0631\u0641 \u0645\u0631\u062d\u0644\u06c1 9 \u0645\u06cc\u06ba \u067e\u0627\u06cc\u0627 \u06af\u06cc\u0627 \u062a\u06be\u0627\u06d4<\/p>\n<\/li>\n<\/ol>\n<h2 id=\"heading-step-4-point-it-at-the-real-plan\">\u0645\u0631\u062d\u0644\u06c1 4: \u0627\u067e\u0646\u06d2 \u0627\u0635\u0644 \u0645\u0646\u0635\u0648\u0628\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u0631\u06cc\u06ba\u06d4<\/h2>\n<p>\u0679\u06cc\u0631\u0627 \u06af\u0648\u0679 \u067e\u0644\u0627\u0646 \u06a9\u06d2 \u062e\u0644\u0627\u0641 \u0627\u06cc\u06a9 \u067e\u06cc\u06a9\u062c \u06a9\u0627 \u0627\u0646\u062f\u0627\u0632\u06c1 \u0644\u06af\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">opa eval --data policy --input plan.json --format pretty 'data.terraform.network.deny'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">[\n  \"aws_security_group.web-node: ingress rule exposes port 22 to 0.0.0.0\/0\"\n]\n<\/code><\/pre>\n<p>\u067e\u0627\u0644\u06cc\u0633\u06cc \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0627\u06cc\u06a9 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u06ba \u0627\u0648\u0631 \u067e\u0648\u0631\u0679 80 \u067e\u0631 \u062e\u0627\u0645\u0648\u0634 \u0631\u06c1\u06cc\u06ba\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0639\u0648\u0627\u0645\u06cc \u0648\u06cc\u0628 \u0633\u0631\u0648\u0631 \u06a9\u0627 \u062f\u0644 \u06c1\u06d2\u060c \u0627\u0633\u06cc \u0648\u0633\u06cc\u0644\u06d2 \u0633\u06d2 \u062f\u0646\u06cc\u0627 \u06a9\u06d2 \u0633\u0627\u0645\u0646\u06d2 \u0622\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u0686\u06cc\u06a9 \u062c\u0648 \u062f\u0648\u0646\u0648\u06ba \u06a9\u0648 \u062c\u06be\u0646\u0688\u0627 \u0644\u06af\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u06cc\u06a9 \u0627\u06cc\u0633\u0627 \u0686\u06cc\u06a9 \u06c1\u06d2 \u062c\u0633\u06d2 \u0644\u0648\u06af \u0646\u0638\u0631 \u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u0646\u0627 \u0633\u06cc\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0641\u06cc \u067e\u06cc\u06a9\u06cc\u062c \u0627\u06cc\u06a9 \u06a9\u0645\u0627\u0646\u0688 \u0686\u0644\u0627\u0646\u06d2 \u0633\u06d2 \u067e\u06cc\u0645\u0627\u0646\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0631\u06cc\u06af\u0648 \u0627\u06cc\u06a9 \u06c1\u06cc \u0633\u0648\u0627\u0644 \u0645\u06cc\u06ba \u067e\u0648\u0631\u06cc \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u06a9\u0648 \u062c\u0645\u0639 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\">opa eval --data policy --input plan.json --format pretty \n  'union({v | v := data.terraform[_].deny})'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">[\n  \"aws_security_group.web-node: ingress rule exposes port 22 to 0.0.0.0\/0\",\n  \"aws_security_group.web-node: missing required tag \"cost-center\"\",\n  \"aws_security_group.web-node: missing required tag \"data-classification\"\",\n  \"aws_security_group.web-node: missing required tag \"owner\"\",\n  \"aws_vpc.web_vpc: missing required tag \"cost-center\"\",\n  \"aws_vpc.web_vpc: missing required tag \"data-classification\"\",\n  \"aws_vpc.web_vpc: missing required tag \"owner\"\"\n]\n<\/code><\/pre>\n<p><code>{v | v := data.terraform[_].deny}<\/code>    \u06cc\u06c1 \u062c\u0645\u0639 \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u0633\u0645\u062c\u06be\u0646\u06d2 \u06a9\u06cc \u0635\u0644\u0627\u062d\u06cc\u062a \u06c1\u06d2\u06d4 <code>deny<\/code> \u0630\u06cc\u0644 \u0645\u06cc\u06ba \u062a\u0645\u0627\u0645 \u067e\u06cc\u06a9\u062c\u0648\u06ba \u0645\u06cc\u06ba \u062a\u0631\u062a\u06cc\u0628\u0627\u062a <code>data.terraform<\/code>\u0627\u0648\u0631 <code>union<\/code> \u0627\u0646\u06c1\u06cc\u06ba \u0641\u0644\u06cc\u0679 \u0628\u0646\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u0622\u067e \u0627\u06cc\u06a9 \u0646\u0626\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u0641\u0627\u0626\u0644 \u06a9\u0648 \u0627\u0633 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u0645\u06cc\u06ba \u0688\u0627\u0644\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u0627\u0633\u06d2 \u06a9\u0645\u0627\u0646\u0688 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u06cc\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u0679\u06be\u0627\u06cc\u0627 \u062c\u0627\u0626\u06d2 \u06af\u0627\u06d4<\/p>\n<h2 id=\"heading-step-5-turn-the-verdict-into-an-exit-code\">\u0645\u0631\u062d\u0644\u06c1 5: \u0641\u06cc\u0635\u0644\u0648\u06ba \u06a9\u0648 \u0627\u06cc\u06af\u0632\u0679 \u06a9\u0648\u0688\u0632 \u0645\u06cc\u06ba \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/h2>\n<p>CI \u06af\u06cc\u0679\u0633 \u0627\u06cc\u06af\u0632\u0679 \u0633\u0679\u06cc\u0679\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0628\u0627\u062a \u0686\u06cc\u062a \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u062f\u0648\u0646\u0648\u06ba \u0642\u0633\u0645 \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc\u0648\u06ba \u06a9\u0648 \u0627\u06cc\u06a9 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u06cc\u06a9\u062c\u0627 \u06a9\u0631\u0646\u0627 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0679\u0648\u0679\u06cc \u06c1\u0648\u0626\u06cc \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u0627\u06cc\u06a9 \u0645\u06c1\u06cc\u0646\u06d2 \u0645\u06cc\u06ba \u06a9\u06cc\u0633\u06d2 \u06af\u0632\u0631\u062a\u06cc \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0622\u0644\u06c1 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u067e\u0627\u0633 \u0648\u0631\u0688<\/th>\n<th>\u0641\u06cc\u0635\u0644\u06c1<\/th>\n<th>\u0645\u0639\u0646\u06cc<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>0<\/td>\n<td>\u067e\u0627\u0633<\/td>\n<td>\u0645\u06cc\u06ba \u0646\u06d2 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0686\u0644\u0627\u0626\u06cc \u0627\u0648\u0631 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0686\u06cc\u06a9 \u06a9\u06cc\u0627\u060c \u0644\u06cc\u06a9\u0646 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u0645\u0644\u0627\u06d4<\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>\u0646\u0627\u06a9\u0627\u0645<\/td>\n<td>\u06c1\u0645 \u0646\u06d2 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0646\u0627\u0641\u0630 \u06a9\u06cc\u0627 \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u06a9\u0627 \u067e\u062a\u06c1 \u0686\u0644\u0627\u06d4<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>\u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u0646\u0627<\/td>\n<td>\u067e\u0627\u0644\u06cc\u0633\u06cc \u0686\u0644\u0627\u0626\u06cc \u06af\u0626\u06cc\u060c \u0644\u06cc\u06a9\u0646 \u06a9\u0686\u06be \u0628\u06be\u06cc \u0686\u06cc\u06a9 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u06af\u06cc\u0627\u060c \u0644\u06c1\u0630\u0627 \u0646\u062a\u0627\u0626\u062c \u0628\u06d2 \u0645\u0639\u0646\u06cc \u06c1\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>\u063a\u0644\u0637<\/td>\n<td>\u0679\u0648\u0644 \u06cc\u0627 \u0627\u0633 \u06a9\u0627 \u0627\u0646 \u067e\u0679 \u062f\u0633\u062a\u06cc\u0627\u0628 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u0686\u0648\u062a\u06be\u06cc \u0642\u0637\u0627\u0631 \u0648\u06c1 \u06c1\u06d2 \u062c\u06c1\u0627\u06ba \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u062f\u0631\u0648\u0627\u0632\u06d2 \u063a\u0644\u0637 \u06c1\u0648 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u06af\u0631 \u067e\u0644\u0627\u0646 \u06a9\u06d2 \u067e\u0627\u0633 \u0648\u06c1 \u0648\u0633\u0627\u0626\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba \u062c\u0646 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0645\u0639\u0644\u0648\u0645 \u06c1\u06d2\u060c \u0631\u067e\u0648\u0631\u0679\u0646\u06af \u067e\u0627\u0633 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633 \u06cc\u0642\u06cc\u0646 \u062f\u06c1\u0627\u0646\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0639\u0645\u0644\u062f\u0631\u0622\u0645\u062f \u0641\u0631\u0627\u06c1\u0645 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u0627\u06d4 \u0627\u0633 \u06a9\u0627 \u0627\u067e\u0646\u0627 \u0641\u06cc\u0635\u0644\u06c1 \u0646\u0627\u0645 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 \u0645\u06cc\u06ba \u062e\u062a\u0645 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u0627 \u0635\u0641\u0631 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<p>\u0628\u0646\u0627\u0646\u0627 <code>policy_gate.py<\/code>:<\/p>\n<pre><code class=\"language-python\">\"\"\"Evaluate a Terraform plan against a directory of Rego policies.\"\"\"\n\nimport argparse\nimport json\nimport pathlib\nimport shutil\nimport subprocess\nimport sys\n\nPASS, FAIL, BROKEN = 0, 1, 2\n\nDENY_QUERY = \"union({v | v := data.terraform[_].deny})\"\nCONSIDERED_QUERY = \"union({v | v := data.terraform[_].considered})\"\n\n\ndef die(message: str) -> None:\n    print(f\"policy-gate: {message}\", file=sys.stderr)\n    sys.exit(BROKEN)\n\n\ndef load_plan(path: pathlib.Path) -> dict:\n    try:\n        text = path.read_text()\n    except OSError as exc:\n        die(f\"cannot read {path}: {exc.strerror}\")\n    try:\n        return json.loads(text)\n    except json.JSONDecodeError as exc:\n        die(f\"{path}:{exc.lineno}:{exc.colno}: invalid JSON: {exc.msg}\")\n\n\ndef query(opa: str, policy_dirs: list[pathlib.Path], plan: pathlib.Path, expr: str) -> list:\n    command = [opa, \"eval\", \"--input\", str(plan), \"--format\", \"raw\"]\n    for directory in policy_dirs:\n        command += [\"--data\", str(directory)]\n    command.append(expr)\n\n    result = subprocess.run(command, capture_output=True, text=True)\n    if result.returncode != 0:\n        die(f\"opa failed: {result.stderr.strip() or result.stdout.strip()}\")\n    values = json.loads(result.stdout)\n    # A rule that yields anything but strings is a policy bug, and sorting a\n    # mixed list would surface it as an unrelated TypeError.\n    for value in values:\n        if not isinstance(value, str):\n            die(f\"{expr} produced a {type(value).__name__}; \"\n                \"deny and considered rules must yield strings\")\n    return values\n\n\ndef main() -> int:\n    parser = argparse.ArgumentParser(description=__doc__)\n    parser.add_argument(\"--plan\", required=True, type=pathlib.Path,\n                        help=\"JSON from `terraform show -json`\")\n    parser.add_argument(\"--policy\", required=True, nargs=\"+\", type=pathlib.Path,\n                        help=\"one or more directories of .rego files\")\n    parser.add_argument(\"--opa\", default=\"opa\", help=\"path to the opa binary\")\n    args = parser.parse_args()\n\n    if shutil.which(args.opa) is None:\n        die(f\"{args.opa} is not on PATH\")\n    for directory in args.policy:\n        if not directory.is_dir():\n            die(f\"{directory} is not a directory\")\n\n    plan = load_plan(args.plan)\n    if \"resource_changes\" not in plan:\n        die(f\"{args.plan} has no resource_changes key; is it a Terraform plan?\")\n\n    considered = query(args.opa, args.policy, args.plan, CONSIDERED_QUERY)\n    if not considered:\n        # Reporting a pass here would claim an assurance the run cannot give.\n        print(f\"VACUOUS: no policy examined any of the \"\n              f\"{len(plan['resource_changes'])} planned resource(s)\", file=sys.stderr)\n        return BROKEN\n\n    violations = sorted(query(args.opa, args.policy, args.plan, DENY_QUERY))\n    if violations:\n        print(f\"FAIL: {len(violations)} violation(s) \"\n              f\"across {len(considered)} examined resource(s)\", file=sys.stderr)\n        for violation in violations:\n            print(f\"  - {violation}\", file=sys.stderr)\n        return FAIL\n\n    print(f\"PASS: {len(considered)} resource(s) examined, no violations\")\n    return PASS\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n<\/code><\/pre>\n<p>\u0627\u0633\u06a9\u0631\u067e\u0679 \u06a9\u06cc \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba:<\/p>\n<ol>\n<li>\n<p><code>argparse<\/code>    \u0633\u06a9\u0648\u0631 <code>--plan<\/code> \u0627\u0648\u0631 <code>--policy<\/code> \u067e\u0633\u0646\u062f <code>required=True<\/code>\u0627\u0648\u0631 <code>--policy<\/code> \u06cc\u06c1 \u0644\u06cc\u062a\u0627 \u06c1\u06d2 <code>nargs=\"+\"<\/code>\u0644\u06c1\u0630\u0627\u060c \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u062e\u0627\u0644\u06cc \u0641\u06c1\u0631\u0633\u062a \u062a\u062c\u0632\u06cc\u06c1 \u06a9\u0631\u062a\u06d2 \u0648\u0642\u062a \u0627\u06cc\u06a9 \u062e\u0631\u0627\u0628\u06cc \u06a9\u0627 \u0633\u0628\u0628 \u0628\u0646\u06d2 \u06af\u06cc\u06d4<\/p>\n<\/li>\n<li>\n<p><code>load_plan<\/code>    JSON \u0646\u062d\u0648\u06cc \u063a\u0644\u0637\u06cc\u0648\u06ba \u06a9\u06cc \u0642\u0637\u0627\u0631 \u0627\u0648\u0631 \u06a9\u0627\u0644\u0645 \u0631\u067e\u0648\u0631\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 <code>json.JSONDecodeError<\/code> \u0644\u06d2 \u062c\u0627\u0646\u0627 <code>lineno<\/code> \u0627\u0648\u0631 <code>colno<\/code> \u0627\u06cc\u06a9 \u06af\u06cc\u0679 \u062c\u0648 \u0635\u0631\u0641 \"Bad JSON\" \u06a9\u06c1\u062a\u0627 \u06c1\u06d2 \u06a9\u0633\u06cc \u06a9\u06cc \u062f\u0648\u067e\u06c1\u0631 \u06a9\u0648 \u0636\u0627\u0626\u0639 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0646\u0627\u06a9\u0627\u0645\u06cc \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u0631\u0627\u0633\u062a\u06d2 \u0627\u0633 \u0633\u06d2 \u06af\u0632\u0631\u06d2 \u06c1\u06cc\u06ba: <code>die<\/code>\u06cc\u06c1 \u06c1\u0645\u06cc\u0634\u06c1 2 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062e\u062a\u0645 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 <code>opa<\/code>\u0646\u0627\u0642\u0627\u0628\u0644 \u067e\u0691\u06be\u0646\u06d2 \u0641\u0627\u0626\u0644\u06cc\u06ba \u0627\u0648\u0631 <code>resource_changes<\/code> \u0627\u0633 \u06a9\u06d2 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0637\u0648\u0631 \u067e\u0631\u060c \u06cc\u06c1 \u0633\u0628 \u0679\u0648\u0644 \u0645\u06cc\u06ba \u06c1\u06cc \u063a\u0644\u0637\u06cc \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u06a9\u06c1 <code>considered<\/code> \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u067e\u0631 \u0639\u0645\u0644 \u062f\u0631\u0622\u0645\u062f <em>\u067e\u06c1\u0644\u06d2<\/em> \u06a9\u06c1 <code>deny<\/code> \u0633\u0648\u0627\u0644 \u0627\u06af\u0631 \u06a9\u0686\u06be \u0628\u06be\u06cc \u0686\u06cc\u06a9 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u067e\u06be\u0627\u0646\u0633\u06cc \u062e\u062a\u0645 \u06c1\u0648\u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 <code>VACUOUS<\/code> \u0622\u067e \u06a9\u0648 \u0627\u067e\u0646\u0627 \u067e\u0627\u0633 \u067e\u0631\u0646\u0679 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u0645\u0648\u0642\u0639 \u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u0645\u0644\u062a\u0627\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0648\u06ba \u06a9\u0648 \u062a\u0631\u062a\u06cc\u0628 \u062f\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0627\u06cc\u06a9 \u06c1\u06cc \u0645\u0646\u0635\u0648\u0628\u06c1 \u06c1\u0631 \u0631\u0646 \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u06c1\u06cc \u0628\u0627\u0626\u0679 \u0648\u0627\u0631 \u0622\u0624\u0679 \u067e\u0679 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u06d2 \u06af\u0627\u060c \u0627\u0648\u0631 \u062f\u0648 CI \u0644\u0627\u06af\u0632 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0641\u0631\u0642 \u0645\u0639\u0646\u06cc \u062e\u06cc\u0632 \u06c1\u0648\u06af\u0627\u06d4<\/p>\n<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"https:\/\/umang.pk\/wp-content\/uploads\/2026\/10\/1790852630_954_\u06a9\u0648\u0688-\u0627\u0648\u0631-OPA-\u06a9\u06d2-\u0628\u0637\u0648\u0631-\u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba-\u06a9\u06d2-\u0633\u0627\u062a\u06be-AI-\u0633\u06d2.png\" alt=\"\u067e\u0627\u0644\u06cc\u0633\u06cc \u0644\u06cc\u0628 \u06a9\u06d2 \u0639\u0646\u0648\u0627\u0646 \u0633\u06d2 \u0627\u06cc\u06a9 \u0679\u0631\u0645\u06cc\u0646\u0644 \u0648\u0646\u0688\u0648\u06d4 \u062c\u0628 \u0622\u067e \u0627\u0648\u067e\u0627 \u0679\u06cc\u0633\u0679 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0686\u0644\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u06cc\u06c1 PASS \u06a9\u0648\u0644\u0646 20 \u0633\u0644\u06cc\u0634 20 \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4 TerraGoat \u067e\u0644\u0627\u0646 \u06a9\u06d2 \u0633\u0627\u062a\u06be python3policy_gate.py \u0686\u0644\u0627\u0646\u06d2 \u0633\u06d2 \u062f\u0648 \u0686\u06cc\u06a9 \u0634\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644 \u067e\u0631 FAIL \u06a9\u0627\u0644\u0648\u0646 7 \u06a9\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u067e\u0631\u0646\u0679 \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u067e\u0648\u0631\u0679 22 \u0633\u06d2 0.0.0.0\/0 \u06a9\u0648 \u0638\u0627\u06c1\u0631 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0627\u06cc\u06a9 \u062f\u0627\u062e\u0644\u06cc \u0627\u0635\u0648\u0644 \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2 aws_security_group.web-node \u0627\u0648\u0631 aws_vpc.web_vpc \u0633\u06d2\u06d4 \u0627\u06cc\u06a9\u0648 \u0688\u0627\u0644\u0631 \u06a9\u0627 \u0633\u0648\u0627\u0644\u06cc\u06c1 \u0646\u0634\u0627\u0646 \u0648\u0627\u067e\u0633\u06cc 1\" style=\"display: block;\" width=\"600\" height=\"400\" loading=\"lazy\" title=\"\"><\/p>\n<p>\u0627\u0633 \u067e\u0644\u0627\u0646 \u0645\u06cc\u06ba \u062f\u0648 \u0648\u0633\u0627\u0626\u0644 \u0645\u06cc\u06ba 7 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0627\u06ba \u06c1\u06cc\u06ba\u060c \u0627\u06cc\u06af\u0632\u0679 \u06a9\u0648\u0688 \u06a9\u06d2 \u0633\u0627\u062a\u06be CI \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/umang.pk\/wp-content\/uploads\/2026\/10\/1790852631_927_\u06a9\u0648\u0688-\u0627\u0648\u0631-OPA-\u06a9\u06d2-\u0628\u0637\u0648\u0631-\u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba-\u06a9\u06d2-\u0633\u0627\u062a\u06be-AI-\u0633\u06d2.png\" alt=\"\u067e\u0627\u0644\u06cc\u0633\u06cc \u0644\u06cc\u0628 \u06a9\u06d2 \u0639\u0646\u0648\u0627\u0646 \u0633\u06d2 \u0627\u06cc\u06a9 \u0679\u0631\u0645\u06cc\u0646\u0644 \u0648\u0646\u0688\u0648\u06d4 python3policy_gate.py \u06a9\u0648 \u062e\u0627\u0644\u06cc \u067e\u0644\u0627\u0646 \u06a9\u06d2 \u062e\u0644\u0627\u0641 \u0686\u0644\u0627\u0646\u0627 0 \u0645\u0646\u0635\u0648\u0628\u06c1 \u0628\u0646\u062f \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0686\u06cc\u06a9 \u06a9\u06cc\u06d2 \u0628\u063a\u06cc\u0631 VACUOUS \u06a9\u0627\u0644\u0648\u0646 \u0646\u0648\u067e\u0627\u0644\u06cc\u0633\u06cc \u067e\u0631\u0646\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9\u0648 \u0688\u0627\u0644\u0631 \u06a9\u0627 \u0633\u0648\u0627\u0644\u06cc\u06c1 \u0646\u0634\u0627\u0646 0 \u06a9\u06cc \u0628\u062c\u0627\u0626\u06d2 2 \u0648\u0627\u067e\u0633 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4\" style=\"display: block;\" width=\"600\" height=\"400\" loading=\"lazy\" title=\"\"><\/p>\n<p>\u06cc\u06c1 \u0627\u06cc\u06a9 \u06af\u06cc\u0679 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062e\u0627\u0644\u06cc \u0645\u0646\u0635\u0648\u0628\u06d2 \u067e\u0631 \u0648\u06c1\u06cc \u0679\u0648\u0644 \u06c1\u06d2 \u062c\u0648 \"\u067e\u0627\u0633\" \u06a9\u0627 \u062c\u0648\u0627\u0628 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>GitHub \u0627\u06cc\u06a9\u0634\u0646\u0632 \u0648\u0631\u06a9 \u0641\u0644\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u0648 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u062c\u0627\u0646\u0686\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-yaml\">name: policy\n\non: [pull_request]\n\njobs:\n  policy:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v5\n\n      - name: Install OPA\n        run: |\n          curl -L -o \/usr\/local\/bin\/opa \n            https:\/\/openpolicyagent.org\/downloads\/v1.20.2\/opa_linux_amd64_static\n          chmod +x \/usr\/local\/bin\/opa\n\n      # The policies are code. Lint and test them before trusting them.\n      - name: Check policy syntax\n        run: opa check --strict policy\n\n      - name: Verify formatting\n        run: opa fmt --fail --diff policy\n\n      - name: Test policies\n        run: opa test policy --verbose --coverage --format json > coverage.json\n\n      # Only now does anything get judged.\n      - name: Evaluate Terraform plan\n        run: python3 policy_gate.py --plan plan.json --policy policy\n<\/code><\/pre>\n<p>\u0627\u0633\u06d2 \u0628\u0644\u0627\u06a9 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0635\u0631\u0641 \u062f\u0648 \u06c1\u0641\u062a\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06af\u06cc\u0679 \u0631\u067e\u0648\u0631\u0679\u0646\u06af \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0631\u0648\u0644 \u0622\u0624\u0679 \u06a9\u0631\u06cc\u06ba\u06d4 \u062c\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u0633\u062a \u0645\u0639\u0644\u0648\u0645 \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba \u0648\u06c1 \u067e\u0631\u0627\u067e\u0631\u0679\u06cc \u06a9\u06d2 \u0633\u0627\u062e\u062a\u06cc \u062d\u0635\u0648\u06ba \u067e\u0631 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648 \u062c\u0627\u0626\u06cc\u06ba \u06af\u06cc\u060c \u0627\u0648\u0631 \u0622\u067e \u0627\u0633\u06d2 \u0628\u0644\u0627\u06a9 \u0634\u062f\u06c1 \u0631\u06cc\u0644\u06cc\u0632 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0644\u0627\u06af \u0644\u0627\u0626\u0646 \u0645\u06cc\u06ba \u062a\u0644\u0627\u0634 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u0628\u06c1\u062a\u0631 \u06c1\u0648\u06ba \u06af\u06d2\u06d4<\/p>\n<h2 id=\"heading-step-6-enforce-at-admission-time\">\u0645\u0631\u062d\u0644\u06c1 6: \u062f\u0627\u062e\u0644\u06d2 \u06a9\u06d2 \u0648\u0642\u062a \u0644\u0627\u06af\u0648 \u06a9\u06cc\u0627 \u06af\u06cc\u0627\u06d4<\/h2>\n<p>\u0645\u0631\u062d\u0644\u06c1 5 \u0645\u06cc\u06ba \u06af\u06cc\u0679 \u0627\u0633 \u0628\u0627\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u06cc\u0627 \u062a\u0642\u0633\u06cc\u0645 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0646\u0638\u0631 \u0646\u06c1\u06cc\u06ba \u0622\u062a\u0627 <code>kubectl apply<\/code> \u06a9\u0633\u06cc \u06a9\u06d2 \u0644\u06cc\u067e \u0679\u0627\u067e \u0633\u06d2\u060c \u06a9\u0633\u06cc \u0648\u06cc\u0646\u0688\u0631 \u06a9\u06d2 \u06c1\u06cc\u0644\u0645 \u0686\u0627\u0631\u0679 \u0633\u06d2\u060c \u06cc\u0627 \u0627\u06cc\u06a9 \u0622\u067e\u0631\u06cc\u0679\u0631 \u062c\u0648 \u0627\u067e\u0646\u06d2 \u0634\u06cc\u0688\u0648\u0644 \u06a9\u06d2 \u0645\u0637\u0627\u0628\u0642 \u067e\u0648\u0688\u0632 \u0628\u0646\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062f\u0627\u062e\u0644\u06c1 \u06a9\u0646\u0679\u0631\u0648\u0644 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u060c \u0627\u0648\u0631 Kubernetes \u0627\u0628 \u0627\u0633 \u0645\u06cc\u06ba \u0628\u0644\u0679 \u0627\u0646 \u06c1\u06d2\u06d4<\/p>\n<p><code>ValidatingAdmissionPolicy<\/code>    \u0627\u0633 \u06a9\u06d2 \u0628\u0639\u062f \u0633\u06d2 \u06cc\u06c1 \u0639\u0627\u0645 \u0637\u0648\u0631 \u067e\u0631 \u062f\u0633\u062a\u06cc\u0627\u0628 \u06c1\u0648 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 <strong>v1.30<\/strong>\u06a9\u0633\u06cc \u0628\u06be\u06cc \u0648\u06cc\u0628 \u06c1\u06a9\u0633 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u067e\u0646\u06d2 API \u0633\u0631\u0648\u0631 \u06a9\u06d2 \u0627\u0646\u062f\u0631 CELs \u06a9\u0648 \u062a\u0639\u06cc\u0646\u0627\u062a \u06a9\u0631\u0646\u06d2 \u06cc\u0627 \u0641\u0639\u0627\u0644 \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u0646\u062f\u0627\u0632\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-yaml\">apiVersion: admissionregistration.k8s.io\/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n  name: require-trusted-registry\nspec:\n  failurePolicy: Fail\n  matchConstraints:\n    resourceRules:\n      - apiGroups: [\"\"]\n        apiVersions: [\"v1\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n        resources: [\"pods\"]\n  variables:\n    # A Pod has three container lists. A policy that reads only\n    # spec.containers is bypassed by moving the image to an initContainer.\n    - name: allImages\n      expression: >-\n        object.spec.containers.map(c, c.image) +\n        object.spec.?initContainers.orValue([]).map(c, c.image) +\n        object.spec.?ephemeralContainers.orValue([]).map(c, c.image)\n  validations:\n    - expression: >-\n        variables.allImages.all(i, i.startsWith('registry.internal.example.com\/'))\n      messageExpression: >-\n        'images must come from registry.internal.example.com: ' +\n        variables.allImages.filter(i,\n          !i.startsWith('registry.internal.example.com\/')).join(', ')\n      reason: Forbidden\n<\/code><\/pre>\n<p>\u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u0633 \u0648\u0642\u062a \u062a\u06a9 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06cc \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u067e\u0627\u0628\u0646\u062f\u06cc \u06a9\u0648 \u0686\u0627\u0644\u0648 \u0646\u06c1 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4 \u06cc\u06c1 \u0622\u067e \u06a9\u0648 \u0627\u06cc\u06a9 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-yaml\">apiVersion: admissionregistration.k8s.io\/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n  name: require-trusted-registry-binding\nspec:\n  policyName: require-trusted-registry\n  validationActions: [\"Deny\"]\n  matchResources:\n    namespaceSelector:\n      matchLabels:\n        policy.example.com\/enforce: \"true\"\n<\/code><\/pre>\n<p>\u0633\u06cc\u0679 <code>validationActions: [\"Warn\", \"Audit\"]<\/code>\u0627\u06cc\u06a9 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u067e\u0631 \u0644\u06cc\u0628\u0644 \u0644\u06af\u0627\u0626\u06cc\u06ba\u060c \u0627\u06cc\u06a9 \u06c1\u0641\u062a\u06d2 \u062a\u06a9 \u0627\u0633 \u06a9\u0627 \u0645\u0634\u0627\u06c1\u062f\u06c1 \u06a9\u0631\u06cc\u06ba\u060c \u0627\u0648\u0631 \u067e\u06be\u0631 \u0627\u06af\u0644\u06d2 \u067e\u0631 \u062c\u0627\u0626\u06cc\u06ba\u06d4 <code>[\"Deny\"]<\/code> \u0633\u0644\u06cc\u06a9\u0679\u0631 \u06a9\u0648 \u067e\u06be\u06cc\u0644\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<p>\u06a9\u06c1 <code>initContainers<\/code> \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0645\u0633\u0626\u0644\u06c1 \u06a9\u0648 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u0646\u0627 \u0627\u0645\u06cc\u062c \u067e\u0631\u0648\u0648\u06cc\u0646\u0633 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u0648 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 \u0637\u0631\u06cc\u0642\u06c1 \u06c1\u06d2\u06d4 <code>?<\/code> \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u0641\u06cc\u0644\u0688 \u0646\u062d\u0648 <code>.orValue([])<\/code> \u0645\u06a9\u0645\u0644 \u0627\u0638\u06c1\u0627\u0631 \u06a9\u06cc \u063a\u0644\u0637\u06cc \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0645\u0645\u06a9\u0646\u06c1 \u063a\u0644\u0637\u06cc\u0648\u06ba \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u06a9\u0648 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0637\u0631\u06cc\u0642\u06c1 \u06cc\u06c1 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u0646 \u062f\u0648\u0646\u0648\u06ba \u0645\u06cc\u0646\u06cc \u0641\u06cc\u0633\u0679\u0633 \u06a9\u0648 \u0644\u0627\u06af\u0648 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u0627 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u067e\u0631\u0648\u0633\u06cc\u0633 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0626\u06cc \u06a9\u0644\u0633\u0679\u0631 \u0646\u06c1\u06cc\u06ba \u062a\u06be\u06d2\u06d4 \u0627\u0633\u06d2 v1 \u0631\u06cc\u0641\u0631\u0646\u0633 \u0627\u0633\u06a9\u06cc\u0645\u0627 \u06a9\u06d2 \u062e\u0644\u0627\u0641 \u0686\u06cc\u06a9 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u062a\u06be\u0627 \u0627\u0648\u0631 \u0627\u0635\u0644 API \u0633\u0631\u0648\u0631 \u0646\u06d2 \u0627\u0633 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u0646\u06c1\u06cc\u06ba \u062f\u06cc \u062a\u06be\u06cc\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u06c1\u0645 \u0646\u06d2 \u0627\u0633\u06d2 \u0627\u06cc\u06a9 \u0646\u0642\u0637\u06c1 \u0622\u063a\u0627\u0632 \u0633\u0645\u062c\u06be\u0627 \u0627\u0648\u0631 <code>Warn<\/code> \u0645\u0648\u0688 (\u06a9\u0686\u06be \u062c\u0648 \u0622\u067e \u06a9\u0648 \u0628\u06c1\u0631\u062d\u0627\u0644 \u06a9\u0631\u0646\u0627 \u06c1\u06d2)\u06d4<\/p>\n<p>Kyverno \u0633\u06d2 \u0634\u0631\u0648\u0639 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2\u060c \u062f\u0648 \u062f\u06cc\u06af\u0631 \u0627\u0646\u062c\u0646 \u0628\u0691\u06d2 \u067e\u06cc\u0645\u0627\u0646\u06d2 \u067e\u0631 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u0645\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4 \u06a9\u06c1 <strong>\u0645\u0627\u0631\u0686 2026 \u0645\u06cc\u06ba CNCF \u06af\u0631\u06cc\u062c\u0648\u06cc\u0634\u0646<\/strong> \u0627\u0633\u06d2 \u0628\u0644\u0648\u0645\u0628\u0631\u06af\u060c \u06a9\u0648\u0627\u0626\u0646 \u0628\u06cc\u0633\u060c \u0688\u0648\u0626\u0686\u06d2 \u0679\u06cc\u0644\u06cc \u06a9\u0627\u0645\u060c \u0644\u0646\u06a9\u0688 \u0627\u0646\u060c \u0627\u0648\u0631 \u0627\u0633\u067e\u0627\u0679\u0627\u0626\u0641 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631\u06cc \u0645\u0642\u0627\u0635\u062f \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba YAML \u0645\u06cc\u06ba \u0644\u06a9\u06be\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u067e\u0644\u06cc\u0679 \u0641\u0627\u0631\u0645 \u0679\u06cc\u0645 \u06a9\u0648 \u06a9\u0633\u06cc \u0646\u0626\u06cc \u0632\u0628\u0627\u0646 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0628\u0644\u0679 \u0627\u0646 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u062a\u062e\u0644\u06cc\u0642\u060c \u062a\u0635\u0648\u06cc\u0631\u06cc \u062f\u0633\u062a\u062e\u0637 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642\u060c \u0627\u0648\u0631 \u0635\u0641\u0627\u0626\u06cc \u06a9\u0648 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0633\u06d2 \u062a\u0646\u06c1\u0627 \u0686\u06be\u0648\u0691 \u062f\u06cc\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u062c\u0628 \u0622\u067e \u0627\u06cc\u06a9 \u0631\u06cc\u06af\u0648 \u06a9\u0648\u0688\u0628\u06cc\u0633 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u06a9\u0628\u0631\u0646\u06cc\u0679\u0633 \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 OPA \u06af\u06cc\u0679 \u06a9\u06cc\u067e\u0631 \u062c\u0648\u0627\u0628 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 <em>\u0627\u0648\u0631<\/em> \u0679\u06cc\u0631\u0627\u0641\u0627\u0631\u0645 <em>\u0627\u0648\u0631<\/em> CI \u0648\u06c1 \u062c\u06af\u06c1 \u06c1\u06d2 \u062c\u06c1\u0627\u06ba \u06cc\u06c1 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644 \u0628\u0646\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u062a\u067e\u0631\u06cc\u0648\u0631\u062a\u0646 \u0628\u06be\u06cc \u0627\u0628 \u0628\u0644\u0679 \u0627\u0646 \u06c1\u06cc\u06ba\u06d4 <code>MutatingAdmissionPolicy<\/code> \u067e\u0631 \u0645\u0633\u062a\u062d\u06a9\u0645 <strong>v1.36<\/strong>.<\/p>\n<h2 id=\"heading-step-7-let-a-model-write-the-policy\">\u0645\u0631\u062d\u0644\u06c1 7: \u0645\u0627\u0688\u0644 \u06a9\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0644\u06a9\u06be\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba\u06d4<\/h2>\n<p>\u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0628\u0648\u0631\u0646\u06af \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0645\u0627\u0688\u0644 \u0628\u0648\u0631\u0646\u06af \u06c1\u0648\u0646\u06d2 \u0645\u06cc\u06ba \u0627\u0686\u06be\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062a\u0648 \u0648\u0627\u0636\u062d \u0627\u0642\u062f\u0627\u0645 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0645\u0627\u0688\u0644 \u06a9\u0648 \u06cc\u06c1 \u0644\u06a9\u06be\u0646\u06d2 \u062f\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u06cc\u0633\u06d2 \u0633\u0648\u0627\u0644\u0627\u062a \u06c1\u06cc\u06ba \u062c\u0646 \u06a9\u06cc \u0622\u067e \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0627\u06cc\u06a9 \u0645\u0646\u0679 \u0645\u06cc\u06ba \u067e\u06cc\u0645\u0627\u0626\u0634 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0628\u0627\u0644\u06a9\u0644 \u0648\u06c1\u06cc \u06c1\u06d2 \u062c\u0648 \u0645\u06cc\u06ba \u0627\u0633 \u0645\u0631\u062d\u0644\u06d2 \u06a9\u06d2 \u0622\u062e\u0631 \u0645\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u0648\u06ba\u06d4 \u0639\u0648\u0627\u0645\u06cc \u062a\u0631\u0628\u06cc\u062a \u06a9\u06d2 \u0627\u0639\u062f\u0627\u062f \u0648 \u0634\u0645\u0627\u0631 \u0645\u06cc\u06ba \u0631\u06cc\u06af\u0648 \u06a9\u0627 \u0627\u06cc\u06a9 \u0627\u06c1\u0645 \u062d\u0635\u06c1 \u06c1\u06d2\u06d4 <strong>\u0644\u06cc\u06af\u0648 v0<\/strong>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0627\u06cc\u0633\u06cc \u0628\u0648\u0644\u06cc \u06c1\u06d2 \u062c\u0633 \u06a9\u0627 \u062a\u062c\u0632\u06cc\u06c1 \u06a9\u0631\u0646\u0627 \u0628\u0646\u062f \u06c1\u0648 \u06af\u06cc\u0627 \u062a\u06be\u0627 \u062c\u0628 OPA 1.0 \u062c\u0646\u0648\u0631\u06cc 2025 \u0645\u06cc\u06ba \u0631\u06cc\u0644\u06cc\u0632 \u06c1\u0648\u0627 \u062a\u06be\u0627\u06d4 \u0627\u06cc\u06a9 \u0645\u0627\u0688\u0644 \u062c\u0648 \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 \u067e\u06cc\u0679\u0631\u0646 \u062a\u06a9 \u067e\u06c1\u0646\u0686\u062a\u0627 \u06c1\u06d2 \u0648\u06c1 \u0628\u0648\u0644\u06cc\u0648\u06ba \u062a\u06a9 \u067e\u06c1\u0646\u0686 \u062c\u0627\u0626\u06d2 \u06af\u0627 \u062c\u0633\u06d2 \u0645\u0648\u062c\u0648\u062f\u06c1 \u062a\u062c\u0632\u06cc\u06c1 \u06a9\u0627\u0631 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u0648\u0646\u06cc\u0648\u0631\u0633\u0679\u06cc \u0622\u0641 \u06a9\u0644\u0627\u0628\u0631\u06cc\u0627 \u06af\u0631\u0648\u067e \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 2025 \u067e\u0631\u06cc \u067e\u0631\u0646\u0679\u061b <em>ARPaCCino<\/em>\u06c1\u0645 \u0627\u067e\u0646\u06d2 Terraform \u06a9\u06cc\u0633 \u0627\u0633\u0679\u0688\u06cc \u0645\u06cc\u06ba \u0627\u0633\u06cc \u0627\u062b\u0631 \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062c\u0628 \u0679\u0648\u0644 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0631\u06cc\u06af\u0648 \u0633\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06cc \u06af\u0626\u06cc \u062a\u0648 Qwen3-30B \u0627\u0648\u0631 GPT-4o \u06c1\u0631 \u0627\u06cc\u06a9 \u0646\u06d2 5 \u0645\u06cc\u06ba \u0633\u06d2 0 \u0646\u062d\u0648\u06cc \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u0633\u062a \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u062a\u06cc\u0627\u0631 \u06a9\u06cc\u06ba\u06d4 OPA \u062f\u0633\u062a\u0627\u0648\u06cc\u0632 \u0645\u06cc\u06ba \u062a\u0644\u0627\u0634 \u0634\u0627\u0645\u0644 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u0628\u062f\u0644\u062a\u0627\u06d4 \u0627\u06cc\u06a9 \u0644\u0648\u067e \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u06cc\u06ba \u062c\u0648 \u0645\u0627\u0688\u0644 \u0686\u0644 \u0633\u06a9\u06d2\u06d4 <code>opa check<\/code> \u0627\u06af\u0631 \u0622\u067e \u063a\u0644\u0637\u06cc\u0627\u06ba \u067e\u0691\u06be\u06cc\u06ba \u062a\u0648 \u0648\u06c1 4\/5 \u0627\u0648\u0631 5\/5 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u06cc\u06c1 \u0634\u0645\u0627\u0631 \u0627\u06cc\u06a9 \u0686\u06be\u0648\u0679\u06d2 \u06a9\u06cc\u0633 \u0627\u0633\u0679\u0688\u06cc \u0633\u06d2 \u06c1\u06cc\u06ba\u060c \u0644\u06c1\u0630\u0627 \u0633\u0645\u062a \u06a9\u0648 \u0646\u062a\u0627\u0626\u062c \u06a9\u06d2 \u067e\u0627\u0626\u06cc\u062f\u0627\u0631 \u062d\u0635\u06d2 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0633\u0645\u062c\u06be\u06cc\u06ba\u06d4<\/p>\n<p>\u0641\u06cc\u0688 \u0628\u06cc\u06a9 \u0644\u0648\u067e \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0645\u0633\u0626\u0644\u06c1 \u062d\u0644 \u06c1\u0648 \u06af\u06cc\u0627\u06d4 <strong>\u0644\u0648\u067e\u0633 \u06a9\u06cc \u06a9\u0648\u0626\u06cc \u0642\u06cc\u0645\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/strong>\u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06c1\u0645 \u0627\u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06c1\u06cc \u0628\u0646\u0627 \u0686\u06a9\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>opa check --strict<\/code>\u060c <code>opa fmt<\/code>\u0627\u0648\u0631 <code>opa test<\/code>.<\/p>\n<p>\u0644\u06c1\u0630\u0627 \u0627\u06cc\u06a9 \u0627\u0644\u0679 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0644\u0648\u067e \u0628\u0646\u0627\u0626\u06cc\u06ba \u062c\u0648 \u0627\u0633\u06d2 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0628\u0646\u0627\u062a\u0627 \u06c1\u06d2\u06d4 <strong>\u0645\u06cc\u06ba \u0679\u06cc\u0633\u0679 \u0644\u06a9\u06be\u062a\u0627 \u06c1\u0648\u06ba\u060c \u0645\u0627\u0688\u0644 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0644\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/strong> \u0679\u06cc\u0633\u0679 \u0641\u06a9\u0633\u0686\u0631 JSON \u0628\u0644\u0627\u0628 \u06a9\u0648 \u067e\u0691\u06be\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u06c1\u062a\u0627 \u06c1\u06d2 \"\u06c1\u0627\u06ba\u060c \u0627\u0633\u06d2 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\" 3 \u0633\u06cc\u06a9\u0646\u0688 \u06a9\u06d2 \u0627\u0646\u062f\u0631\u060c \u0627\u0633 \u06a9\u0627 \u062c\u0627\u0626\u0632\u06c1 \u0644\u06cc\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u062e\u0635\u0648\u0635 \u0627\u0648\u0631 \u0633\u0633\u062a\u0627 \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06d2 \u0646\u06cc\u0633\u0679\u0688 \u0641\u06c1\u0645 \u06a9\u06d2 \u0633\u0627\u062a\u06be\u060c \u0631\u06cc\u06af\u0648 \u06a9\u0648 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0627\u0641\u06cc \u0645\u062d\u0646\u062a \u062f\u0631\u06a9\u0627\u0631 \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633\u06d2 \u063a\u0644\u0637 \u067e\u0691\u06be\u0646\u0627 \u0622\u0633\u0627\u0646 \u06c1\u06d2\u06d4 \u0644\u0648\u06af\u0648\u06ba \u06a9\u0648 \u062c\u06af\u06c1 \u062f\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u062c\u0627\u0626\u0632\u06c1 \u0644\u06cc\u0646\u06d2 \u06a9\u06d2 \u0627\u062e\u0631\u0627\u062c\u0627\u062a \u06a9\u0645 \u06c1\u0648\u06ba\u060c \u0627\u0648\u0631 \u0645\u0634\u06cc\u0646\u06cc\u06ba \u0686\u0644\u0627\u0626\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u0622\u0624\u0679 \u067e\u0679 \u06a9\u0648 \u0645\u06cc\u06a9\u0627\u0646\u06a9\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0686\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u06d2\u06d4<\/p>\n<p>\u0628\u0646\u0627\u0646\u0627 <code>policy_forge.py<\/code>:<\/p>\n<pre><code class=\"language-python\">\"\"\"Generate a Rego policy from a rule in English, and keep it only if the toolchain agrees.\"\"\"\n\nimport argparse\nimport pathlib\nimport re\nimport subprocess\nimport sys\nimport tempfile\n\nWRITTEN, REJECTED, BROKEN = 0, 1, 2\n\nSYSTEM = \"\"\"You write Open Policy Agent policies in Rego v1 (OPA 1.0+).\n\nRules:\n- Use `if` on every rule body and `contains` for multi-value rules.\n- Do not emit `import rego.v1`; it is redundant on OPA 1.0+.\n- The input is the JSON from `terraform show -json`.\n- Return one ```rego block and nothing else.\"\"\"\n\n\ndef extract_rego(reply: str) -> str:\n    blocks = re.findall(r\"```regon(.*?)```\", reply, re.DOTALL)\n    if not blocks:\n        raise ValueError(\"model returned no rego block\")\n    if len(blocks) > 1:\n        raise ValueError(f\"model returned {len(blocks)} rego blocks; expected one\")\n    return blocks[0]\n\n\ndef verify(opa: str, policy: str, tests: pathlib.Path) -> tuple[bool, str]:\n    with tempfile.TemporaryDirectory() as tmp:\n        bundle = pathlib.Path(tmp)\n        # The tests keep their own name; the policy gets one that cannot\n        # collide with it, whatever the caller named the test file.\n        (bundle \/ \"candidate_policy.rego\").write_text(policy)\n        (bundle \/ tests.name).write_text(tests.read_text())\n\n        for command in ([opa, \"check\", \"--strict\"], [opa, \"test\"]):\n            result = subprocess.run(command + [str(bundle)], capture_output=True, text=True)\n            if result.returncode != 0:\n                return False, (result.stdout + result.stderr).strip()\n    return True, \"opa check and opa test both passed\"\n\n\ndef forge(rule: str, tests: pathlib.Path, ask, opa: str, attempts: int) -> str:\n    transcript = [{\n        \"role\": \"user\",\n        \"content\": (\n            f\"Write a Rego policy for this rule:nn{rule}nn\"\n            f\"It must satisfy these tests:nn```regon{tests.read_text()}```\"\n        ),\n    }]\n\n    for attempt in range(1, attempts + 1):\n        reply = ask(transcript)\n        policy = extract_rego(reply)\n        ok, output = verify(opa, policy, tests)\n        headline = next(iter(output.splitlines()), \"no output from the toolchain\")\n        print(f\"attempt {attempt}: {'PASS' if ok else 'FAIL'} - {headline}\", file=sys.stderr)\n        if ok:\n            return policy\n        transcript += [\n            {\"role\": \"assistant\", \"content\": reply},\n            {\"role\": \"user\", \"content\": f\"The toolchain rejected that:nn{output}nnFix it.\"},\n        ]\n\n    raise RuntimeError(f\"no policy survived {attempts} attempts\")\n\n\ndef claude(model: str):\n    import anthropic\n\n    client = anthropic.Anthropic()\n\n    def ask(transcript: list[dict]) -> str:\n        response = client.messages.create(\n            model=model,\n            max_tokens=16000,\n            system=[{\n                \"type\": \"text\",\n                \"text\": SYSTEM,\n                \"cache_control\": {\"type\": \"ephemeral\"},\n            }],\n            thinking={\"type\": \"adaptive\"},\n            messages=transcript,\n        )\n        return \"\".join(b.text for b in response.content if b.type == \"text\")\n\n    return ask\n\n\ndef main() -> int:\n    parser = argparse.ArgumentParser(description=__doc__)\n    parser.add_argument(\"--rule\", required=True, help=\"the policy, in one English sentence\")\n    parser.add_argument(\"--tests\", required=True, type=pathlib.Path,\n                        help=\"a _test.rego file you wrote by hand\")\n    parser.add_argument(\"--out\", required=True, type=pathlib.Path,\n                        help=\"where to write the policy, only if it passes\")\n    parser.add_argument(\"--model\", default=\"claude-opus-5\")\n    parser.add_argument(\"--attempts\", type=int, default=4)\n    parser.add_argument(\"--opa\", default=\"opa\")\n    args = parser.parse_args()\n\n    if args.attempts < 1:\n        print(\"policy-forge: --attempts must be at least 1\", file=sys.stderr)\n        return BROKEN\n    if not args.tests.is_file():\n        print(f\"policy-forge: {args.tests} does not exist\", file=sys.stderr)\n        return BROKEN\n\n    try:\n        policy = forge(args.rule, args.tests, claude(args.model), args.opa, args.attempts)\n    except RuntimeError as exc:\n        print(f\"policy-forge: {exc}; nothing written\", file=sys.stderr)\n        return REJECTED\n    except ValueError as exc:\n        print(f\"policy-forge: {exc}\", file=sys.stderr)\n        return BROKEN\n\n    args.out.write_text(policy)\n    print(f\"policy-forge: verified policy written to {args.out}\", file=sys.stderr)\n    return WRITTEN\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n<\/code><\/pre>\n<pre><code class=\"language-bash\">export ANTHROPIC_API_KEY=...\npython3 policy_forge.py \n  --rule \"No security group may expose an administrative port to the public internet.\" \n  --tests policy\/network_test.rego \n  --out policy\/generated.rego\n<\/code><\/pre>\n<p>\u0644\u0648\u067e \u06a9\u06cc \u0636\u0645\u0627\u0646\u062a \u06cc\u06c1 \u06c1\u06d2:<\/p>\n<ol>\n<li>\n<p><strong>\u062a\u0635\u062f\u06cc\u0642 \u0627\u06cc\u06a9 \u0630\u06cc\u0644\u06cc \u0639\u0645\u0644 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0686\u0644\u062a\u06cc \u06c1\u06d2\u06d4<\/strong> \u0645\u0627\u0688\u0644 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u067e\u0648\u0686\u06be\u062a\u0627 \u06a9\u06c1 \u06a9\u06cc\u0627 \u067e\u0627\u0644\u06cc\u0633\u06cc \u062f\u0631\u0633\u062a \u06c1\u06d2\u06d4 <code>opa check<\/code> \u0627\u0648\u0631 <code>opa test<\/code> \u0641\u06cc\u0635\u0644\u06c1 \u0627\u0648\u0631 \u0627\u06cc\u06af\u0632\u0679 \u06a9\u0648\u0688 \u0648\u0627\u062d\u062f \u062b\u0628\u0648\u062a \u06c1\u06cc\u06ba \u062c\u0648 \u0644\u0648\u067e \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u0646\u0627\u06a9\u0627\u0645\u06cc \u062e\u0627\u0645\u060c \u063a\u06cc\u0631 \u062e\u0644\u0627\u0635\u06c1 \u0679\u0648\u0644 \u0622\u0624\u0679 \u067e\u0679 \u06a9\u0648 \u0644\u0648\u0679\u0627\u062a\u06cc \u06c1\u06d2\u06d4<\/strong> \u06a9\u0645\u067e\u0627\u0626\u0644\u0631 \u06a9\u06cc \u063a\u0644\u0637\u06cc\u0627\u06ba \u0627\u0648\u0631 \u0679\u06cc\u0633\u0679 \u0645\u06cc\u06ba \u0646\u0627\u06a9\u0627\u0645\u06cc\u0627\u06ba \u0633\u0628 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0633\u06af\u0646\u0644 \u0641\u06cc\u0688 \u0628\u06cc\u06a9 \u06c1\u06cc\u06ba \u062c\u0648 \u0627\u06cc\u06a9 \u0645\u0627\u0688\u0644 \u06a9\u0648 \u0645\u0644 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u060c \u06cc\u0627 \u0627\u0633\u06d2 \u062f\u0648\u0633\u0631\u06d2 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u06a9\u06c1\u06cc\u06ba\u060c \u0648\u06c1 \u0645\u062f\u062f\u06af\u0627\u0631 \u0628\u0679\u0633 \u06a9\u0648 \u062e\u062a\u0645 \u06a9\u0631 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u06a9\u0686\u06be \u0628\u06be\u06cc \u0688\u0633\u06a9 \u062a\u06a9 \u0646\u06c1\u06cc\u06ba \u067e\u06c1\u0646\u0686\u062a\u0627 \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u06cc\u06c1 \u06af\u0632\u0631 \u0646\u06c1 \u062c\u0627\u0626\u06d2\u06d4<\/strong> <code>forge<\/code>    \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0648\u0627\u067e\u0633 \u06a9\u0631 \u062f\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06cc\u06ba \u06cc\u0627 \u0628\u0691\u06be\u0627 \u062f\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u062f\u0648\u0628\u0627\u0631\u06c1 \u06a9\u0648\u0634\u0634 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u0628\u062c\u0679 \u062e\u062a\u0645 \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u0648\u062c\u06c1 \u0633\u06d2 \u063a\u06cc\u0631 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u0648 \u0627\u0633\u0679\u0648\u0631 \u0645\u06cc\u06ba \u0645\u062d\u0641\u0648\u0638 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u06a9\u0648\u0626\u06cc \u0631\u0627\u0633\u062a\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ol>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 \u0644\u0648\u067e \u06a9\u0648 \u0686\u0644\u0627\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u06a9\u0631\u067e\u0679 \u0645\u0627\u0688\u0644 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u0627 \u062a\u0627\u06a9\u06c1 \u0645\u06cc\u06ba API \u06a9\u0644\u06cc\u062f \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0646\u062a\u0627\u0626\u062c \u06a9\u0648 \u062f\u0648\u0628\u0627\u0631\u06c1 \u067e\u06cc\u0634 \u06a9\u0631 \u0633\u06a9\u0648\u06ba\u06d4 \u062a\u06cc\u0646 \u062c\u0648\u0627\u0628\u0627\u062a \u0627\u06cc\u06a9 \u062d\u0642\u06cc\u0642\u062a \u067e\u0633\u0646\u062f\u0627\u0646\u06c1 v0 \u0646\u062d\u0648\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc\u060c \u0627\u06cc\u06a9 \u062d\u0642\u06cc\u0642\u062a \u067e\u0633\u0646\u062f\u0627\u0646\u06c1 \u0644\u06cc\u06a9\u0646 \u063a\u0644\u0637 v1 \u067e\u0627\u0644\u06cc\u0633\u06cc\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u062a\u06cc\u0646 \u0633\u0637\u062d\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u062a\u06be\u06d2\u06d4<\/p>\n<pre><code class=\"language-plaintext\">attempt 1: FAIL - 2 errors occurred during loading:\nattempt 2: FAIL - policy\/network_test.rego:63:\nattempt 3: PASS - opa check and opa test both passed\n<\/code><\/pre>\n<p>\u067e\u06c1\u0644\u06cc \u06a9\u0648\u0634\u0634 \u0631\u06cc\u06af\u0648 v0 \u062a\u06be\u06cc\u060c <code>deny[msg] { ... }<\/code> \u06cc\u06c1 \u0627\u06cc\u06a9 \u0627\u06cc\u0633\u0627 \u0641\u0627\u0631\u0645 \u06c1\u06d2 \u062c\u0633 \u0646\u06d2 \u062c\u0646\u0648\u0631\u06cc 2025 \u0645\u06cc\u06ba OPA 1.0 \u06a9\u06d2 \u062c\u0627\u0631\u06cc \u06c1\u0648\u0646\u06d2 \u067e\u0631 \u062a\u062c\u0632\u06cc\u06c1 \u06a9\u0631\u0646\u0627 \u0628\u0646\u062f \u06a9\u0631 \u062f\u06cc\u0627 \u062a\u06be\u0627\u06d4 \u0627\u0648\u0631 \u06cc\u06c1 \u0639\u0648\u0627\u0645\u06cc \u062a\u0639\u0644\u06cc\u0645\u06cc \u0688\u06cc\u0679\u0627 \u0645\u06cc\u06ba \u0628\u06c1\u062a \u0632\u06cc\u0627\u062f\u06c1 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4 <code>opa check --strict<\/code> \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u0633\u06d2 \u0627\u0645\u062a\u062d\u0627\u0646 \u0645\u06cc\u06ba \u0622\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06c1\u06cc \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc\u0627\u06d4<\/p>\n<p>\u06a9\u0648\u0634\u0634 2 \u0627\u06cc\u06a9 \u062f\u0631\u0633\u062a \u0631\u06cc\u06af\u0648 v1 \u062a\u06be\u06cc\u06d4 \u0633\u0628 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u062c\u0627\u0626\u0632\u06c1 \u067e\u0627\u0633 \u06a9\u06cc\u0627 \u0644\u06cc\u06a9\u0646 \u067e\u06be\u0631 \u0628\u06be\u06cc <strong>8 \u0645\u06cc\u06ba \u0633\u06d2 4<\/strong> \u0633\u0648\u06cc\u0679 \u062a\u06a9\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06c1\u0645 \u0646\u06d2 \u0645\u0648\u0627\u0632\u0646\u06c1 \u06a9\u06cc\u0627\u06d4 <code>ingress.from_port<\/code> \u06a9\u06d2 \u062e\u0644\u0627\u0641 <code>admin_ports<\/code> \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a\u060c \u062f\u0627\u0626\u0631\u06c1 \u06a9\u0627\u0631 \u06a9\u0648 \u0646\u0638\u0631 \u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0635\u0631\u0641 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 <code>cidr_blocks<\/code>. <code>opa check<\/code> \u0645\u062c\u06be\u06d2 \u06a9\u0648\u0626\u06cc \u0634\u06a9\u0627\u06cc\u062a \u0646\u06c1\u06cc\u06ba \u062a\u06be\u06cc \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06a9\u0648\u0688 \u0628\u0627\u0644\u06a9\u0644 \u0679\u06be\u06cc\u06a9 \u0645\u0646\u0638\u0645 \u062a\u06be\u0627\u06d4<\/p>\n<p><strong>\u0627\u06cc\u06a9 \u0627\u0686\u06be\u06cc \u0637\u0631\u062d \u0633\u06d2 \u0628\u0646\u0627\u0626\u06cc \u06af\u0626\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u0628 \u0628\u06be\u06cc \u0627\u06cc\u06a9 \u0628\u0631\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u06c1\u0648 \u0633\u06a9\u062a\u06cc \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0635\u0631\u0641 \u0648\u06c1\u06cc \u0686\u06cc\u0632 \u062c\u0648 \u062c\u0627\u0646\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u0627\u0633 \u0644\u0648\u067e \u0645\u06cc\u06ba \u06a9\u06cc\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba \u0648\u06c1 \u0679\u06cc\u0633\u0679\u0648\u06ba \u06a9\u0627 \u0645\u062c\u0645\u0648\u0639\u06c1 \u06c1\u06d2 \u062c\u0648 \u0622\u067e \u0644\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/strong><\/p>\n<p>\u0631\u06cc\u06a9\u0648\u0631\u06cc \u0644\u0648\u067e \u0646\u06cc\u0631\u0633 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u06c1\u0631 \u06a9\u0648\u0634\u0634 \u063a\u0644\u0637\u06cc \u06a9\u06d2 \u067e\u06cc\u063a\u0627\u0645 \u067e\u0631 \u0645\u0634\u0631\u0648\u0637 \u0627\u06cc\u06a9 \u0646\u0626\u06cc \u062a\u062e\u0644\u06cc\u0642 \u06c1\u06d2\u06d4 \u0686\u0648\u062a\u06be\u06cc \u06a9\u0648\u0634\u0634 \u062a\u06cc\u0633\u0631\u06cc \u06a9\u0648\u0634\u0634 \u06a9\u06cc \u06a9\u0686\u06be \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u06a9\u06be\u0648 \u0633\u06a9\u062a\u06cc \u06c1\u06d2\u060c \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u062c\u0648 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u0686\u06a9\u0627 \u06c1\u06d2 \u0648\u06c1 \u0622\u06af\u06d2 \u0646\u06c1\u06cc\u06ba \u0628\u0691\u06be\u06d2 \u06af\u0627\u06d4 \u0627\u0633 \u0688\u06cc\u0632\u0627\u0626\u0646 \u0645\u06cc\u06ba \u06a9\u0686\u06be \u0628\u06be\u06cc \u0627\u0633 \u06a9\u0627 \u067e\u062a\u06c1 \u0646\u06c1\u06cc\u06ba \u0644\u06af\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u062c\u0627\u0646\u0686\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0635\u0631\u0641 \u0648\u06c1\u06cc \u0679\u06cc\u0633\u0679 \u0633\u0648\u0679 \u06c1\u06d2 \u062c\u0648 \u0622\u067e \u0646\u06d2 \u0644\u06a9\u06be\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06c1\u0645 \u062f\u0648\u0628\u0627\u0631\u06c1 \u06a9\u0648\u0634\u0634\u0648\u06ba \u06a9\u06cc \u062a\u0639\u062f\u0627\u062f \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u067e\u0646\u06d2 \u0633\u0648\u0679 \u06a9\u0648 \u0628\u0691\u06be\u0627\u0646\u0627 \u062c\u0627\u0631\u06cc \u0631\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0628\u0646\u0627\u0626\u06cc \u06af\u0626\u06cc \u06c1\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u067e\u0644 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u062f\u06cc\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0633\u06d2 \u0636\u0645 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0645\u0646\u0638\u0648\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-step-8-govern-the-agent-itself\">\u0645\u0631\u062d\u0644\u06c1 8: \u0627\u06cc\u062c\u0646\u0679 \u0633\u06cc\u0644\u0641 \u0645\u06cc\u0646\u06cc\u062c\u0645\u0646\u0679<\/h2>\n<p>AI \u0627\u06cc\u062c\u0646\u0679\u0633 \u0627\u062f\u0627\u06a9\u0627\u0631 \u0627\u0648\u0631 \u06a9\u0627\u0644 \u0679\u0648\u0644\u0632 \u0628\u06be\u06cc \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u06c1\u0631 \u0679\u0648\u0644 \u06a9\u0627\u0644 \u0627\u062c\u0627\u0632\u062a \u06a9\u0627 \u0641\u06cc\u0635\u0644\u06c1 \u0628\u0646 \u062c\u0627\u062a\u06cc \u06c1\u06d2 \u062c\u0633\u06d2 \u06a9\u0686\u06be \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p>\u0635\u0646\u0639\u062a \u062a\u06cc\u0632\u06cc \u0633\u06d2 \u0627\u0633 \u067e\u0631 \u0627\u06a9\u0679\u06be\u0627 \u06c1\u0648\u06af\u0626\u06cc\u06d4 Amazon Bedrock AgentCore \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0639\u0627\u0645 \u0637\u0648\u0631 \u067e\u0631 \u0645\u0627\u0631\u0686 2026 \u0645\u06cc\u06ba \u0633\u06cc\u0688\u0631 \u06a9\u06d2 \u06af\u06cc\u0679 \u0648\u06cc\u0632 \u067e\u0631 \u0627\u06cc\u062c\u0646\u0679 \u0679\u0648\u0644 \u06a9\u0627\u0644\u0632 \u06a9\u0627 \u062c\u0627\u0626\u0632\u06c1 \u0644\u06cc\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062c\u0627\u0631\u06cc \u06a9\u06cc \u06af\u0626\u06cc\u06ba\u06d4 \u0627\u06cc\u06a9 \u0639\u0627\u0645 \u0627\u0648\u067e\u0646 \u0633\u0648\u0631\u0633 \u067e\u06cc\u0679\u0631\u0646 \u0627\u06cc\u06a9 MCP \u0679\u0648\u0644\u0632 \u06af\u06cc\u0679 \u0648\u06d2 \u06a9\u06d2 \u0633\u0627\u0645\u0646\u06d2 \u0627\u06cc\u06a9 OPA \u0633\u0627\u0626\u0688 \u06a9\u0627\u0631 \u06c1\u06d2\u06d4<\/p>\n<p>\u062a\u062d\u0642\u06cc\u0642 \u0627\u0646\u06c1\u06cc \u062d\u062f\u0648\u062f \u06a9\u0648 \u0645\u0632\u06cc\u062f \u0645\u0636\u0628\u0648\u0637 \u06a9\u0631 \u0631\u06c1\u06cc \u06c1\u06d2\u06d4 Defects4J \u06a9\u06d2 \u067e\u06cc\u0686\u06be\u06d2 \u06cc\u0648\u0646\u06cc\u0648\u0631\u0633\u0679\u06cc \u0622\u0641 \u0648\u0627\u0634\u0646\u06af\u0679\u0646 \u06af\u0631\u0648\u067e \u0633\u06d2 2026 \u06a9\u0627 \u067e\u0631\u06cc \u067e\u0631\u0646\u0679\u061b <em>LLM \u0627\u06cc\u062c\u0646\u0679\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u062a\u0639\u0645\u06cc\u0644 \u06a9\u06cc \u0679\u0648\u0644 \u0633\u06d2 \u0628\u06c1\u062a\u0631 \u062d\u0644\u0648\u0631 \u06a9\u06cc \u0645\u062f\u062f \u0633\u06d2 \u062a\u0635\u062f\u06cc\u0642<\/em> (\u0648\u0646\u0633\u0679\u0646\u060c \u0648\u0646\u0633\u0679\u0646\u060c \u0627\u0648\u0631 \u062c\u0633\u0679) \u0642\u062f\u0631\u062a\u06cc \u0632\u0628\u0627\u0646 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u0648 SMT \u0631\u06a9\u0627\u0648\u0679\u0648\u06ba \u0645\u06cc\u06ba \u0645\u0631\u062a\u0628 \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u063a\u06cc\u0631 \u0645\u0648\u0627\u0641\u0642 \u06a9\u0627\u0644\u0648\u06ba \u06a9\u0648 \u0631\u0648\u06a9\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 Z3 \u0633\u0648\u0644\u0648\u0631 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<p>\u0648\u06c1 \u0627\u06cc\u06a9 \u062f\u0639\u0648\u06cc \u06a9\u0627 \u0627\u0634\u062a\u0631\u0627\u06a9 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba: <strong>\u0633\u0633\u0679\u0645 \u067e\u0631\u0627\u0645\u067e\u0679\u0633 \u0633\u06d2 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0646\u0627\u0641\u0630 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/strong> \u0627\u0646\u0641\u0648\u0631\u0633\u0645\u0646\u0679 \u06a9\u0627\u0644 \u067e\u0627\u062a\u06be \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0627\u0646\u0679\u0631\u0633\u06cc\u067e\u0679\u0631 \u06c1\u06d2 \u062c\u0648 \"\u0646\u06c1\u06cc\u06ba\" \u0648\u0627\u067e\u0633 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u0627\u0644 \u06a9\u0648 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u0631\u0648\u06a9 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0628\u0646\u0627\u0646\u0627 <code>agent\/authz.rego<\/code>:<\/p>\n<pre><code class=\"language-rego\"># METADATA\n# title: Agent tool-call authorisation\n# description: |\n#   Evaluated once per tool call, before the tool runs. The decision has\n#   three values rather than two, because an agent worth deploying will\n#   sometimes need to do something that a human, not the policy, should\n#   approve.\npackage agent.authz\n\ntool_grants := {\n\t\"support\": {\"search_orders\", \"read_customer\", \"issue_refund\"},\n\t\"analytics\": {\"search_orders\", \"run_query\"},\n}\n\nwrite_tools := {\"issue_refund\", \"run_query\"}\n\nrefund_ceiling_cents := 10000\n\n# An unmapped role, an unknown tool or a malformed input all land here.\ndefault decision := {\"effect\": \"deny\", \"reasons\": [\"no matching grant\"]}\n\ndecision := {\"effect\": effect_for(reasons), \"reasons\": reasons} if {\n\tcount(granted) > 0\n\treasons := escalations\n}\n\ngranted contains role if {\n\tsome role in input.agent.roles\n\tinput.tool in object.get(tool_grants, role, set())\n}\n\neffect_for(reasons) := \"allow\" if count(reasons) == 0\n\neffect_for(reasons) := \"require_approval\" if count(reasons) > 0\n\nescalations contains reason if {\n\tinput.tool in write_tools\n\tnot input.session.human_in_loop\n\treason := sprintf(\"%q writes state and the session is unattended\", [input.tool])\n}\n\n# A refund with no readable amount cannot be checked against the ceiling,\n# so it escalates. Silence here would clear the exact call an attacker\n# would craft.\nescalations contains reason if {\n\tinput.tool == \"issue_refund\"\n\tnot positive_amount\n\treason := \"refund amount is missing, unreadable, or not positive\"\n}\n\n# A negative amount is a charge wearing a refund's name.\npositive_amount if {\n\tamount := object.get(input, [\"arguments\", \"amount_cents\"], null)\n\tis_number(amount)\n\tamount > 0\n}\n\nescalations contains reason if {\n\tinput.tool == \"issue_refund\"\n\tamount := object.get(input, [\"arguments\", \"amount_cents\"], null)\n\tis_number(amount)\n\tamount > refund_ceiling_cents\n\treason := sprintf(\n\t\t\"refund of %d cents exceeds the %d cent ceiling\",\n\t\t[amount, refund_ceiling_cents],\n\t)\n}\n\n# Keyword matching is a coarse guard, and it is here to show the shape of an\n# argument-level rule. Anything holding real data wants a SQL parser: this\n# catches `DROP TABLE` and misses a statement that spells it another way.\ndestructive_sql := `(?i)b(drop|truncate|delete|alter|grant|revoke)b`\n\nescalations contains reason if {\n\tinput.tool == \"run_query\"\n\tregex.match(destructive_sql, object.get(input, [\"arguments\", \"statement\"], \"\"))\n\treason := \"statement contains a destructive SQL keyword\"\n}\n<\/code><\/pre>\n<p>\u0641\u06cc\u0635\u0644\u06d2 \u06a9\u06cc \u0634\u0631\u0627\u0626\u0637 \u0628\u0646\u062f \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u06c1\u0645 \u0627\u0646\u06c1\u06cc\u06ba \u06cc\u06c1\u0627\u06ba \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0628\u06cc\u0627\u0646 \u06a9\u0631\u06cc\u06ba \u06af\u06d2\u06d4<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0627\u062b\u0631<\/th>\n<th>\u0628\u06be\u06cc\u062c\u0646\u06d2 \u0648\u0627\u0644\u0627 \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba<\/td>\n<td>\u0622\u0644\u06d2 \u06a9\u0648 \u0686\u0644\u0627\u0626\u06cc\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0645\u0646\u0638\u0648\u0631\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td>\u0631\u0648\u06a9\u06cc\u06ba\u060c \u0644\u0648\u06af\u0648\u06ba \u06a9\u0648 \u062f\u06a9\u06be\u0627\u0626\u06cc\u06ba \u06a9\u06cc\u0648\u06ba\u060c \u0635\u0631\u0641 \u0645\u0646\u0638\u0648\u0631 \u06c1\u0648\u0646\u06d2 \u067e\u0631 \u06c1\u06cc \u0686\u0644\u0627\u0626\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u0627\u0646\u06a9\u0627\u0631<\/td>\n<td>\u06cc\u06c1 \u0627\u0633\u06d2 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0645\u0646\u0638\u0648\u0631\u06cc \u06a9\u0627 \u06a9\u0648\u0626\u06cc \u0631\u0627\u0633\u062a\u06c1 \u0641\u0631\u0627\u06c1\u0645 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u06cc\u06c1\u0627\u06ba \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0627\u0633 \u0637\u0631\u062d \u06a9\u06cc\u0648\u06ba \u0628\u0646\u0627\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2:<\/p>\n<ol>\n<li>\n<p><code>default decision<\/code> <strong>\u0645\u0633\u062a\u0631\u062f \u06a9\u0631\u06cc\u06ba:<\/strong> \u063a\u06cc\u0631 \u067e\u06c1\u0686\u0627\u0646\u06d2 \u06af\u0626\u06d2 \u0679\u0648\u0644\u0632\u060c \u0648\u06c1 \u06a9\u0631\u062f\u0627\u0631 \u062c\u0646\u06c1\u06cc\u06ba \u0622\u067e \u0646\u0642\u0634\u06c1 \u0628\u0646\u0627\u0646\u0627 \u0628\u06be\u0648\u0644 \u06af\u0626\u06d2\u060c \u06cc\u0627 \u062e\u0631\u0627\u0628 \u0627\u0646 \u067e\u0679 \u0633\u0628 \u06a9\u0686\u06be \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc \u062c\u0648 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0627\u0646 \u067e\u0679 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0641\u06cc\u0644 \u067e\u0631 \u06a9\u06be\u0644\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u06cc \u06c1\u06d2 \u062c\u0633 \u06a9\u06cc \u06a9\u0633\u06cc \u06a9\u0648 \u062a\u0648\u0642\u0639 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06cc\u060c \u06cc\u0639\u0646\u06cc \u0627\u0646 \u067e\u0679 \u062c\u0633 \u06a9\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u062a\u06cc\u0646 \u0642\u062f\u0631\u06cc\u06ba:<\/strong> \u0628\u0627\u0626\u0646\u0631\u06cc \u0627\u062a\u06be\u0627\u0631\u0679\u06cc \u0645\u0641\u06cc\u062f \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc\u0648\u06ba \u06a9\u0648 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u062e\u0637\u0631\u0646\u0627\u06a9 \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc\u0648\u06ba \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u0646\u06d2 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0627\u0646\u062a\u062e\u0627\u0628 \u067e\u0631 \u0645\u062c\u0628\u0648\u0631 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06cc \u062a\u06cc\u0633\u0631\u06cc \u0642\u062f\u0631 \u0627\u0639\u0644\u06cc\u0670 \u062e\u0648\u062f \u0645\u062e\u062a\u0627\u0631\u06cc \u0648\u0627\u0644\u06d2 \u0627\u06cc\u062c\u0646\u0679\u0648\u06ba \u06a9\u0648 \u062c\u0627\u0626\u0632 \u0628\u0646\u0627\u0646\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u0633\u06cc\u0679 \u067e\u0631 \u0648\u0627\u067e\u0633\u06cc \u06a9\u06cc \u0648\u062c\u0648\u06c1\u0627\u062a:<\/strong> \u062a\u0645\u0627\u0645 \u0642\u0627\u0628\u0644 \u0627\u0637\u0644\u0627\u0642 \u0648\u062c\u0648\u06c1\u0627\u062a \u06a9\u0648 \u062c\u0645\u0639 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2. \u0627\u06af\u0631 \u06a9\u0633\u06cc \u06a9\u0648 \u0635\u0628\u062d 3 \u0628\u062c\u06d2 \u0645\u0646\u0638\u0648\u0631\u06cc \u06a9\u0627 \u067e\u06cc\u063a\u0627\u0645 \u0645\u0644\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0648\u06c1 \u0627\u06cc\u06a9 \u067e\u06cc\u063a\u0627\u0645 \u062f\u06cc\u06a9\u06be\u06cc\u06ba \u06af\u06d2 \u06a9\u06c1 \"250,000 \u0633\u06cc\u0646\u0679 \u06a9\u06cc \u0631\u0642\u0645 \u06a9\u06cc \u0648\u0627\u067e\u0633\u06cc 10,000 \u0633\u06cc\u0646\u0679 \u06a9\u06cc \u062d\u062f \u0633\u06d2 \u062a\u062c\u0627\u0648\u0632 \u06a9\u0631 \u06af\u0626\u06cc \u06c1\u06d2\" \u06cc\u06c1 \u0628\u062a\u0627\u0626\u06d2 \u06af\u0627 \u06a9\u06c1 \u0627\u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u06a9\u0631\u0646\u0627 \u06c1\u06d2\u06d4 \"\u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\" \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><strong>\u062f\u0644\u0627\u0626\u0644 \u0628\u06be\u06cc \u0686\u06cc\u06a9 \u06a9\u06cc\u06d2 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/strong> <code>issue_refund<\/code>    \u06cc\u06c1 \u062f\u06cc\u06a9\u06be\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u06a9\u06c1 \u0627\u06cc\u062c\u0646\u0679 \u062d\u0635\u0648\u0644 \u06a9\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u00a35 \u067e\u0631 \u063a\u06cc\u0631 \u0645\u0639\u0645\u0648\u0644\u06cc \u0627\u0648\u0631 \u00a32,500 \u067e\u0631 \u0633\u0646\u062c\u06cc\u062f\u06c1 \u06c1\u06d2\u060c \u0627\u06cc\u062c\u0646\u0679 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0679\u0648\u0644 \u06a9\u0627 \u0646\u0627\u0645 \u06af\u0631\u0627\u0646\u0648\u0644\u0631\u06cc\u0679\u06cc \u0628\u06c1\u062a \u0645\u0648\u0679\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ol>\n<p>15 \u0679\u06cc\u0633\u0679\u0648\u06ba \u0645\u06cc\u06ba \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u06cc \u0645\u06cc\u0632\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba\u060c \u0628\u0634\u0645\u0648\u0644 \u062e\u0627\u0644\u06cc \u0631\u0648\u0644 \u0644\u0633\u0679 \u0648\u0627\u0644\u06d2 \u0627\u06cc\u062c\u0646\u0679\u060c \u0635\u0641\u0631 \u06a9\u06cc \u0631\u0642\u0645 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0631\u0642\u0645 \u06a9\u06cc \u0648\u0627\u067e\u0633\u06cc\u060c \u0627\u0648\u0631 \u0633\u0648\u0627\u0644\u0627\u062a \u06a9\u0648 \u0686\u06be\u067e\u0627\u0646\u0627\u06d4 <code>DROP<\/code> \u0627\u06cc\u06a9 \u0646\u0626\u06cc \u0644\u0627\u0626\u0646 \u06a9\u06d2 \u0628\u0639\u062f:<\/p>\n<pre><code class=\"language-bash\">opa test agent -v\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">PASS: 15\/15\n<\/code><\/pre>\n<p>\u062e\u062f\u0645\u062a \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u06a9\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">opa run --server --addr localhost:8181 agent\/\n<\/code><\/pre>\n<pre><code class=\"language-bash\">curl -s localhost:8181\/v1\/data\/agent\/authz\/decision \n  -d '{\"input\":{\"agent\":{\"roles\":[\"support\"]},\"tool\":\"issue_refund\",\n       \"arguments\":{\"amount_cents\":250000},\"session\":{\"human_in_loop\":true}}}' | jq .result\n<\/code><\/pre>\n<pre><code class=\"language-json\">{\n  \"effect\": \"require_approval\",\n  \"reasons\": [\n    \"refund of 250000 cents exceeds the 10000 cent ceiling\"\n  ]\n}\n<\/code><\/pre>\n<p>\u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u0633 \u0648\u0642\u062a \u062a\u06a9 \u063a\u06cc\u0631 \u0641\u0639\u0627\u0644 \u06c1\u06d2 \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u0622\u067e \u062c\u0648\u0627\u0628 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0622\u06af\u06d2 \u0628\u0691\u06be\u0646\u06d2 \u0633\u06d2 \u0627\u0646\u06a9\u0627\u0631 \u0646\u06c1 \u06a9\u0631 \u062f\u06cc\u06ba\u06d4 \u06cc\u06c1 \u06a9\u0644\u0627\u0626\u0646\u0679 \u06c1\u06d2:<\/p>\n<pre><code class=\"language-python\">import json\nimport urllib.request\n\nOPA_URL = \"http:\/\/localhost:8181\/v1\/data\/agent\/authz\/decision\"\n\n\nclass PolicyDenied(Exception):\n    pass\n\n\nclass ApprovalRequired(Exception):\n    pass\n\n\ndef authorize(agent, tool, arguments, session):\n    payload = json.dumps({\"input\": {\n        \"agent\": agent, \"tool\": tool,\n        \"arguments\": arguments, \"session\": session,\n    }}).encode()\n    req = urllib.request.Request(\n        OPA_URL, data=payload, headers={\"Content-Type\": \"application\/json\"}\n    )\n    with urllib.request.urlopen(req, timeout=2) as resp:\n        body = json.load(resp)\n\n    # OPA returns {} with a 200 when a query matches nothing. Fail closed.\n    decision = body.get(\"result\", {\"effect\": \"deny\", \"reasons\": [\"policy unavailable\"]})\n\n    if decision[\"effect\"] == \"deny\":\n        raise PolicyDenied(\"; \".join(decision[\"reasons\"]))\n    if decision[\"effect\"] == \"require_approval\":\n        raise ApprovalRequired(\"; \".join(decision[\"reasons\"]))\n    return decision\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">search_orders    -> ALLOWED\nissue_refund     -> NEEDS APPROVAL (refund of 250000 cents exceeds the 10000 cent ceiling)\ndelete_account   -> DENIED (no matching grant)\n<\/code><\/pre>\n<p>\u0645\u06cc\u0645\u0648 <code>body.get(\"result\", ...)<\/code>: \u0627\u0648 \u067e\u06cc \u0627\u06d2 \u06a9\u06cc \u0648\u0627\u067e\u0633\u06cc\u06d4 <code>{}<\/code> \u062c\u0628 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0633\u06cc \u0686\u06cc\u0632 \u0633\u06d2 \u0645\u06cc\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u06be\u0627\u062a\u0627 \u06c1\u06d2 \u062a\u0648 \u0627\u0633\u0679\u06cc\u0679\u0633 200 \u06c1\u06d2\u06d4 <code>body[\"result\"]<\/code> \u062a\u0627\u062b\u0631 <code>KeyError<\/code>\u0627\u0648\u0631 \u0627\u0633 \u0628\u0627\u062a \u067e\u0631 \u0645\u0646\u062d\u0635\u0631 \u06c1\u06d2 \u06a9\u06c1 \u0627\u06cc\u062c\u0646\u0679 \u06a9\u0627 \u0641\u0631\u06cc\u0645 \u0648\u0631\u06a9 \u0627\u0646 \u0627\u0633\u062a\u062b\u0646\u06cc\u0670 \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba: <em>\u06a9\u06be\u0644\u0627<\/em>. \u062a\u0645\u0627\u0645 \u067e\u0631\u062a\u06cc\u06ba\u060c \u0628\u0634\u0645\u0648\u0644 \u062a\u062c\u0632\u06cc\u06c1\u060c \u0628\u0637\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u06a9\u0627\u0644 <code>authorize()<\/code> \u0641\u0631\u06cc\u0645 \u0648\u0631\u06a9 \u06a9\u06d2 \u0679\u0648\u0644 \u0627\u06cc\u06af\u0632\u06cc\u06a9\u06cc\u0648\u0634\u0646 \u06c1\u06a9 \u0645\u06cc\u06ba \u0679\u0648\u0644 \u0641\u0646\u06a9\u0634\u0646 \u06a9\u06d2 \u0639\u0645\u0644 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u06d4 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 15 \u0644\u0627\u0626\u0646\u0648\u06ba \u0645\u06cc\u06ba\u060c \u06cc\u06c1 \u0633\u0633\u0679\u0645 \u067e\u0631\u0627\u0645\u067e\u0679 \u06a9\u06cc \u0634\u0627\u0626\u0633\u062a\u06c1 \u062a\u062c\u0627\u0648\u06cc\u0632 \u06a9\u0648 \u0627\u0635\u0644 \u062d\u062f\u0648\u062f \u0645\u06cc\u06ba \u0628\u062f\u0644 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-step-9-what-i-got-wrong\">\u0645\u0631\u062d\u0644\u06c1 9: \u0645\u06cc\u06ba \u0646\u06d2 \u06a9\u06cc\u0627 \u063a\u0644\u0637 \u06a9\u06cc\u0627\u06d4<\/h2>\n<p>\u0645\u0631\u062d\u0644\u06c1 2 \u0627\u0648\u0631 3 \u0645\u06a9\u0645\u0644 \u0634\u062f\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0638\u0627\u06c1\u0631 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0645\u06cc\u06ba \u0633\u0628 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0622\u0633\u0627\u0646 (\u062c\u0633 \u0648\u0631\u0698\u0646 \u067e\u0631 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644 \u0631\u06a9 \u062c\u0627\u062a\u0627 \u06c1\u06d2) \u062a\u06a9 \u067e\u06c1\u0646\u0686 \u06af\u06cc\u0627\u060c \u0644\u06cc\u06a9\u0646 \u0627\u0633 \u0627\u0648\u0631 \u062c\u0648 \u0622\u067e \u0627\u0628\u06be\u06cc \u067e\u0691\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0633 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u062c\u0648 \u0641\u0627\u0635\u0644\u06c1 \u06c1\u06d2 \u0648\u06c1 \u06cc\u06c1\u0627\u06ba \u0633\u0628 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0645\u0641\u06cc\u062f \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-tagging-policy-skipped-the-worst-resources\">\u0679\u06cc\u06af\u0646\u06af \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u0628\u062f\u062a\u0631\u06cc\u0646 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0686\u06be\u0648\u0691 \u0631\u06c1\u06cc \u06c1\u06d2\u06d4<\/h3>\n<p>\u0645\u06cc\u0631\u06d2 \u0645\u0639\u0635\u0648\u0645 <code>in_scope<\/code> \u0642\u0648\u0627\u0639\u062f \u0627\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062e\u062a\u0645 \u06c1\u0648\u0626\u06d2: <code>resource.change.after.tags<\/code>\u0627\u0633\u06d2 \"\u0635\u0631\u0641 \u0679\u06cc\u06af \u06a9\u0631\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644\" \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u067e\u0691\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>Terraform \u0627\u0635\u0644 \u0645\u06cc\u06ba \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0633 \u0633\u06d2 \u0628\u06be\u06cc \u0628\u062f\u062a\u0631 \u06c1\u06d2\u06d4 <code>tags: null<\/code> \u067e\u0631 \u0645\u0634\u062a\u0645\u0644 \u0648\u0633\u0627\u0626\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2: <strong>\u06a9\u0648\u0626\u06cc \u0679\u06cc\u06af \u0628\u0627\u0644\u06a9\u0644 \u0646\u06c1\u06cc\u06ba\u06d4<\/strong>\u0627\u06cc\u06a9 \u063a\u06cc\u0631 \u0645\u062a\u0639\u06cc\u0646\u06c1 \u062a\u0644\u0627\u0634 \u0631\u0648\u0644 \u0628\u0627\u0688\u06cc \u06a9\u06d2 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648\u0646\u06d2 \u06a9\u0627 \u0633\u0628\u0628 \u0628\u0646\u062a\u06cc \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0648\u0633\u0627\u0626\u0644 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u062f\u0627\u0626\u0631\u06c1 \u06a9\u0627\u0631 \u0633\u06d2 \u0628\u0627\u06c1\u0631 \u06c1\u06d2\u06d4<\/p>\n<p>\u0679\u06cc\u0631\u0627 \u06af\u0648\u0679 \u067e\u0644\u0627\u0646 \u06a9\u06d2 \u062f\u0648 \u0648\u0633\u0627\u0626\u0644 \u06c1\u06cc\u06ba: \u0627\u06cc\u06a9 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u067e\u0627\u0646\u0686 \u0648\u0633\u0627\u0626\u0644 \u06c1\u06cc\u06ba: <code>git_*<\/code> \u06a9\u0648\u0626\u06cc \u0679\u06cc\u06af \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u060c \u06a9\u0648\u0626\u06cc \u0645\u0644\u06a9\u06cc\u062a\u06cc \u0679\u06cc\u06af \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u060c \u0644\u06cc\u06a9\u0646 VPC \u06a9\u0686\u06be \u0628\u06be\u06cc \u067e\u0627\u0633 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\">jq -r '.resource_changes[] | \"(.address): tags=(.change.after.tags | type)\"' plan.json\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">aws_security_group.web-node: tags=object\naws_vpc.web_vpc: tags=null\n<\/code><\/pre>\n<pre><code class=\"language-bash\">opa eval --data naive  --input plan.json --format pretty 'count(data.terraform.tags.deny)'\nopa eval --data policy --input plan.json --format pretty 'count(data.terraform.tags.deny)'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">3\n6\n<\/code><\/pre>\n<p>\u0686\u0648\u0646\u06a9\u06c1 \u062a\u06cc\u0646 \u0644\u0627\u067e\u062a\u06c1 \u062a\u0645\u0627\u0645 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u063a\u06cc\u0631 \u0679\u06cc\u06af \u0634\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644 \u067e\u0631 \u062a\u06be\u06d2\u060c \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u06d2 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u06a9\u0686\u06be \u0679\u06cc\u06af\u0632 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062c\u06be\u0646\u0688\u0627 \u0644\u06af\u0627\u06cc\u0627 \u0627\u0648\u0631 \u062e\u0648\u062f \u0628\u062e\u0648\u062f \u063a\u06cc\u0631 \u0679\u06cc\u06af \u0634\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0635\u0627\u0641 \u06a9\u0631\u062f\u06cc\u0627\u06d4<\/p>\n<p><code>tags_of<\/code>    \u0627\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be <code>else := {}<\/code> \u0628\u0631\u0627\u0646\u0686 \u0627\u06cc\u06a9 \u062a\u0631\u0645\u06cc\u0645 \u06c1\u06d2 \u0627\u0648\u0631 \u062a\u06cc\u0646 \u0644\u0627\u0626\u0646\u06cc\u06ba \u0644\u0645\u0628\u06cc \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-network-policy-read-one-of-four-shapes\">\u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0686\u0627\u0631 \u0645\u06cc\u06ba \u0633\u06d2 \u0627\u06cc\u06a9 \u0634\u06a9\u0644 \u0627\u062e\u062a\u06cc\u0627\u0631 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba:<\/h3>\n<p>\u0645\u06cc\u0631\u06cc \u0628\u0648\u0644\u06cc \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc \u067e\u0691\u06be\u06cc\u06ba <code>aws_security_group<\/code> \u0627\u0648\u0631 <code>cidr_blocks<\/code>\u06cc\u06c1 \u0648\u06c1\u06cc \u06c1\u06d2 \u062c\u0648 \u062a\u0645\u0627\u0645 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644\u0632 \u062f\u06a9\u06be\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0644\u06cc\u06a9\u0646 Terraform \u06a9\u06d2 \u067e\u0627\u0633 \u0627\u0633\u06cc \u0627\u0633\u062a\u0642\u0628\u0627\u0644\u06cc\u06c1 \u0627\u0635\u0648\u0644 \u06a9\u0648 \u0638\u0627\u06c1\u0631 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0686\u0627\u0631 \u0637\u0631\u06cc\u0642\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>![Diagram titled \"Four ways Terraform describes one ingress rule\". Four boxes are shown. Top left, aws_security_group.ingress[].cidr_blocks\u060c \u06c1\u0644\u06a9\u06d2 \u0646\u06cc\u0644\u06d2 \u0631\u0646\u06af \u0633\u06d2 \u0628\u06be\u0631\u06d2 \u06c1\u0648\u0626\u06d2 \u0627\u0648\u0631 '\u067e\u0691\u06be\u06cc\u06ba' \u06a9\u0627 \u0644\u06cc\u0628\u0644 \u0644\u06af\u0627 \u06c1\u0648\u0627 \u06c1\u06d2\u06d4 \u0628\u0627\u0642\u06cc \u062a\u06cc\u0646\u0648\u06ba \u06a9\u0627 \u062e\u0627\u06a9\u06c1 \u0633\u0631\u062e \u0631\u0646\u06af \u0645\u06cc\u06ba \u0633\u0631\u062e \u06c1\u06cc\u0686\u0646\u06af \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u0648\u0631 \u0628\u063a\u06cc\u0631 \u067e\u0691\u06be\u06d2 \u06c1\u0648\u0626\u06d2 \u0644\u06cc\u0628\u0644 \u0644\u06af\u0627\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 aws_security_group.ingress[].ipv6_cidr_blocks\u060c aws_vpc_security_group_ingress_rule.cidr_ipv4\u060c \u0627\u0648\u0631 \u0641\u0631\u0633\u0648\u062f\u06c1 aws_security_group_rule\u06d4 \u0646\u06cc\u0644\u06d2 \u0631\u0646\u06af \u06a9\u06d2 \u0628\u06be\u0631\u0646\u06d2 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06c1\u06d2 \u06a9\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06cc\u06c1\u0627\u06ba \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0633\u0631\u062e \u0631\u0646\u06af \u06a9\u06d2 \u06c1\u06cc\u0686 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06c1\u06d2 \u06a9\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06cc\u06c1\u0627\u06ba \u0638\u0627\u06c1\u0631 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4](https:\/\/cdn.hashnode.com\/uploads\/covers\/5f3a74bfc4d5973f55c91c8c\/ab61d36d-78bf-45f7-a073-e6p131er=\"al7073e\")<\/p>\n<p>1 \u0627\u0635\u0648\u0644\u060c 4 \u0627\u0646\u06a9\u0648\u0688\u0646\u06af\u0632\u060c \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0635\u0631\u0641 \u0627\u0648\u067e\u0631 \u0628\u0627\u0626\u06cc\u06ba \u0627\u0646\u062f\u0631\u0627\u062c \u06a9\u0648 \u067e\u0691\u06be\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 \u062a\u06cc\u0646 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06cc \u0627\u0635\u0644 \u062a\u0631\u062a\u06cc\u0628 \u06a9\u06cc \u0645\u0646\u0635\u0648\u0628\u06c1 \u0628\u0646\u062f\u06cc \u06a9\u06cc \u062c\u0648 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06d2 \u0646\u0627\u0642\u0627\u0628\u0644 \u067e\u0691\u06be\u06d2 \u06c1\u0648\u0626\u06d2 \u0641\u0627\u0631\u0645 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 SSH \u06a9\u0648 \u062f\u0646\u06cc\u0627 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u06be\u0648\u0644\u06d2 \u06af\u06cc\u06d4 \u06cc\u06c1 \u062f\u0648\u0646\u0648\u06ba \u0648\u0631\u0698\u0646 \u0645\u06cc\u06ba \u06c1\u06d2\u06d4 <code>code\/<\/code>\u062a\u0648 \u06cc\u06c1 \u062f\u0648\u0628\u0627\u0631\u06c1 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2:<\/p>\n<pre><code class=\"language-bash\">opa eval --data naive --input plan-evasion.json \n  --format pretty 'data.terraform.network.deny'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">[]\n<\/code><\/pre>\n<p>\u06cc\u06c1 3 \u0639\u0648\u0627\u0645\u06cc \u0637\u0648\u0631 \u067e\u0631 \u06a9\u0646\u06cc\u06a9\u0679 \u0627\u06cc\u0628\u0644 SSH \u067e\u0648\u0631\u0679\u0633 \u06c1\u06cc\u06ba\u060c \u06a9\u0648\u0626\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u0646\u06c1\u06cc\u06ba\u060c \u067e\u0631\u0646\u0679 \u0634\u062f\u06c1 \u06af\u06cc\u0679\u06d4 <code>PASS<\/code> \u0627\u0648\u0631 \u06cc\u06c1 0 \u067e\u0631 \u0646\u06a9\u0644\u0627\u06d4<\/p>\n<h3 id=\"heading-a-test-that-was-holding-a-hole-open\">\u0627\u06cc\u06a9 \u06a9\u06be\u0644\u0627 \u0633\u0648\u0631\u0627\u062e \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0679\u06cc\u0633\u0679 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u067e\u0648\u0631\u0679 \u0631\u06cc\u0646\u062c\u0632 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062f\u0648\u0633\u0631\u0627 \u0645\u0633\u0626\u0644\u06c1 \u062a\u06be\u0627\u060c \u0627\u0648\u0631 \u0645\u06cc\u0631\u0627 \u0679\u06cc\u0633\u0679 \u0633\u0648\u06cc\u0679 \u0627\u0646 \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631 \u0631\u06c1\u0627 \u062a\u06be\u0627\u06d4 \u0645\u06cc\u06ba \u0646\u06d2 \u0645\u0646\u062f\u0631\u062c\u06c1 \u0630\u06cc\u0644 \u06a9\u06cc\u0633 \u0644\u06a9\u06be\u0627: <code>test_tolerates_null_ports<\/code>\u06cc\u06c1 \u0645\u0646\u062f\u0631\u062c\u06c1 \u0630\u06cc\u0644 \u0627\u0633\u062a\u0642\u0628\u0627\u0644\u06cc\u06c1 \u0627\u0635\u0648\u0644\u0648\u06ba \u067e\u0631 \u0632\u0648\u0631 \u062f\u06cc\u062a\u0627 \u06c1\u06d2: <code>protocol: \"-1\"<\/code> \u06a9\u0648\u0626\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0626\u06cc \u06a9\u06cc\u0648\u0646\u06a9\u06c1 null \u067e\u0648\u0631\u0679 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0645\u0648\u0627\u0632\u0646\u06c1 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u06c1\u06cc\u06ba \u0679\u0648\u0679\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u067e\u0631\u0648\u0679\u0648\u06a9\u0648\u0644 \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u0627\u0635\u0648\u0644 \u062a\u0645\u0627\u0645 \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u0648\u06ba \u06a9\u0648 \u06a9\u06be\u0648\u0644\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 AWS \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0646\u0646\u062f\u06c1 \u0627\u0646\u06c1\u06cc\u06ba \u0645\u0646\u062f\u0631\u062c\u06c1 \u0630\u06cc\u0644 \u0637\u0648\u0631 \u067e\u0631 \u0644\u0627\u06af \u06a9\u0631\u062a\u0627 \u06c1\u06d2: <code>from_port: 0<\/code> \u0627\u0648\u0631 <code>to_port: 0<\/code>. \u0631\u06cc\u0646\u062c \u0686\u06cc\u06a9 \u0644\u0641\u0638\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0627\u06cc\u06a9 \u0648\u0627\u062d\u062f \u067e\u0648\u0631\u0679 0 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u067e\u0691\u06be\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0648 AWS \u067e\u0631 \u0633\u0628 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0642\u0627\u0628\u0644 \u0627\u062c\u0627\u0632\u062a \u0627\u0635\u0648\u0644 \u06a9\u0648 \u06a9\u0644\u06cc\u0646 \u0633\u06a9\u0648\u0631 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u0646\u0635\u0648\u0628\u06c1 \u06c1\u06d2 <code>code\/plan-all-protocols.json<\/code>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0648\u0633\u06cc\u0644\u06c1 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\">jq -c '.resource_changes[] | select(.type==\"aws_security_group\")\n       | .change.after.ingress[0] | {protocol,from_port,to_port,cidr_blocks}' \n   plan-all-protocols.json\nopa eval --data naive --input plan-all-protocols.json \n   --format pretty 'data.terraform.network.deny'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">{\"protocol\":\"-1\",\"from_port\":0,\"to_port\":0,\"cidr_blocks\":[\"0.0.0.0\/0\"]}\n[]\n<\/code><\/pre>\n<p>\u062a\u0645\u0627\u0645 \u067e\u0631\u0648\u0679\u0648\u06a9\u0648\u0644 \u0627\u0648\u0631 \u062a\u0645\u0627\u0645 \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u06cc\u06ba \u067e\u0648\u0631\u06d2 \u0627\u0646\u0679\u0631\u0646\u06cc\u0679 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u06be\u0644\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0645\u06cc\u06ba \u0646\u06d2 \u062c\u0627\u0646 \u0628\u0648\u062c\u06be \u06a9\u0631 \u062c\u0648 \u0679\u06cc\u0633\u0679 \u0644\u06a9\u06be\u06d2 \u06c1\u06cc\u06ba\u060c \u0648\u06c1 \u0679\u06be\u06cc\u06a9 \u062b\u0627\u0628\u062a \u06c1\u0648\u0626\u06d2\u06d4 \u06cc\u06c1\u0627\u06ba \u0627\u0635\u0644\u0627\u062d\u0627\u062a \u06c1\u06cc\u06ba: <code>covered_ports<\/code>\u067e\u0631\u0648\u0679\u0648\u06a9\u0648\u0644 \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u0627\u0635\u0648\u0644 \u067e\u0648\u0631\u06d2 \u062f\u0627\u0626\u0631\u06c1 \u06a9\u0627\u0631 \u0645\u06cc\u06ba \u0646\u0642\u0634\u06c1 \u0628\u0646\u0627\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0646\u0627\u0642\u0627\u0628\u0644 \u067e\u0691\u06be\u06d2 \u062c\u0627\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0628\u0646\u062f\u0631\u06af\u0627\u06c1\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u063a\u06cc\u0631 \u0645\u062a\u0639\u06cc\u0646\u06c1 \u06c1\u06cc\u06ba\u06d4 <code>deny<\/code> \u063a\u06cc\u0631 \u0645\u062a\u0639\u06cc\u0646\u06c1 \u0645\u0642\u062f\u0645\u0627\u062a \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u0646\u06d2 \u06a9\u0627 \u0627\u0635\u0648\u0644\u06d4 \u0648\u06c1 \u0679\u06cc\u0633\u0679 \u062e\u062a\u0645 \u06c1\u0648 \u06af\u06cc\u0627\u060c \u0627\u0633 \u06a9\u06cc \u062c\u06af\u06c1 \u0686\u0627\u0631 \u0679\u06cc\u0633\u0679 \u06c1\u0648 \u06af\u0626\u06d2\u06d4<\/p>\n<pre><code class=\"language-plaintext\">opa eval --data policy --input plan-all-protocols.json --format pretty 'data.terraform.network.deny'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">[\n  \"aws_security_group.wide_open: ingress rule exposes port 22 to 0.0.0.0\/0\",\n  \"aws_security_group.wide_open: ingress rule exposes port 3306 to 0.0.0.0\/0\",\n  \"aws_security_group.wide_open: ingress rule exposes port 3389 to 0.0.0.0\/0\",\n  \"aws_security_group.wide_open: ingress rule exposes port 5432 to 0.0.0.0\/0\"\n]\n<\/code><\/pre>\n<p>\u0645\u0631\u062d\u0644\u06c1 7 \u062f\u0639\u0648\u06cc \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0679\u06cc\u0633\u0679 \u0633\u0648\u06cc\u0679 \u0644\u0648\u067e \u0645\u06cc\u06ba \u0648\u0627\u062d\u062f \u0646\u0645\u0648\u0646\u06c1 \u06c1\u06d2 \u062c\u0648 \u062c\u0627\u0646\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0635\u0627\u0631\u0641 \u06a9\u06cc\u0627 \u0686\u0627\u06c1\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u0633 \u067e\u0631\u0627\u067e\u0631\u0679\u06cc \u06a9\u06cc \u0642\u06cc\u0645\u062a \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u062e\u0631\u0627\u0628 \u0679\u06cc\u0633\u0679 \u0628\u06be\u06cc \u0627\u06cc\u06a9 \u062e\u0631\u0627\u0628 \u062a\u0635\u0631\u06cc\u062d \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0633 \u0630\u06cc\u0644\u06cc \u062d\u0635\u06d2 \u067e\u0631 \u06a9\u0648\u0626\u06cc \u0628\u062d\u062b \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-what-the-numbers-actually-were\">\u062a\u0639\u062f\u0627\u062f \u0648\u0627\u0642\u0639\u06cc \u06a9\u06cc\u0633\u06cc \u062a\u06be\u06cc\u061f<\/h3>\n<p><img decoding=\"async\" src=\"https:\/\/umang.pk\/wp-content\/uploads\/2026\/10\/1790852631_468_\u06a9\u0648\u0688-\u0627\u0648\u0631-OPA-\u06a9\u06d2-\u0628\u0637\u0648\u0631-\u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba-\u06a9\u06d2-\u0633\u0627\u062a\u06be-AI-\u0633\u06d2.png\" alt=\"\u0639\u0646\u0648\u0627\u0646 \u0627\u0641\u0642\u06cc \u0628\u0627\u0631 \u0686\u0627\u0631\u0679\u06d4 \" style=\"display: block;\" width=\"600\" height=\"400\" loading=\"lazy\" The naive policy missed of the violations showing found as fraction present on two real Terraform For evasion plan open ports scores .000 in red hatching and hardened blue terragoat missing tags .500 both score drawn title=\"\"><\/p>\n<p>\u062f\u0648\u0646\u0648\u06ba \u0648\u0631\u0698\u0646\u0648\u06ba \u0646\u06d2 \u0627\u0633 \u067e\u0644\u0627\u0646 \u0645\u06cc\u06ba 1.000 \u0627\u0633\u06a9\u0648\u0631 \u06a9\u06cc\u06d2 \u062c\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u06cc\u06ba \u0646\u06d2 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0628\u0646\u0627\u0626\u06cc \u062a\u06be\u06cc\u06d4 \u062e\u0644\u0627 \u0635\u0631\u0641 \u0627\u0646 \u0645\u0646\u0635\u0648\u0628\u0648\u06ba \u0645\u06cc\u06ba \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0645\u06cc\u06ba \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u0628\u0646\u0627\u0626\u06d2 \u062a\u06be\u06d2\u06d4<\/p>\n<p>\u062f\u0648 \u062d\u0642\u06cc\u0642\u06cc \u0645\u0646\u0635\u0648\u0628\u0648\u06ba \u0645\u06cc\u06ba <strong>\u0628\u06d2 \u06c1\u0648\u062f\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 9 \u0645\u06cc\u06ba \u0633\u06d2 4 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0627\u06ba \u0645\u0644\u06cc\u06ba\u06d4<\/strong>. \u0627\u0646\u06c1\u0648\u06ba \u0646\u06d2 TerraGoat \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u0645\u06cc\u06ba 1.000 \u06a9\u0627 \u0633\u06a9\u0648\u0631 \u062d\u0627\u0635\u0644 \u06a9\u06cc\u0627\u060c \u062c\u0648 \u0644\u06a9\u06be\u062a\u06d2 \u0648\u0642\u062a \u0645\u06cc\u0631\u06d2 \u0630\u06c1\u0646 \u0645\u06cc\u06ba \u062a\u06be\u0627\u060c \u0627\u0648\u0631 \u062f\u0648 \u0635\u0648\u0631\u062a\u0648\u06ba \u0645\u06cc\u06ba \u062c\u0648 \u0645\u06cc\u06ba \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627\u060c \u0627\u0646\u06c1\u06cc\u06ba 0.000 \u0627\u0648\u0631 0.500 \u06a9\u0627 \u0633\u06a9\u0648\u0631 \u0645\u0644\u0627\u06d4<\/p>\n<h3 id=\"heading-the-part-that-genuinely-surprised-me\">\u0648\u06c1 \u062d\u0635\u06c1 \u062c\u0633 \u0646\u06d2 \u0645\u062c\u06be\u06d2 \u0648\u0627\u0642\u0639\u06cc \u062d\u06cc\u0631\u0627\u0646 \u06a9\u0631\u062f\u06cc\u0627\u06d4<\/h3>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 \u0633\u0648\u0686\u0627 \u06a9\u06c1 \u0679\u06cc\u0633\u0679 \u06a9\u0648\u0631\u06cc\u062c \u0646\u06d2 \u0627\u0633\u06d2 \u067e\u06a9\u0691 \u0644\u06cc\u0627 \u06c1\u0648\u06af\u0627\u060c \u0644\u06cc\u06a9\u0646 \u0627\u06cc\u0633\u0627 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0627\u06d4 \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u0635\u0644 \u0645\u06cc\u06ba \u0644\u06a9\u06be\u06d2 \u06af\u0626\u06d2 \u062f\u0648 \u0679\u06cc\u0633\u0679\u0648\u06ba \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0628\u0648\u0644\u06cc \u0679\u06cc\u06af\u0646\u06af \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u062f\u0648\u0628\u0627\u0631\u06c1 \u062a\u0634\u06a9\u06cc\u0644 \u062f\u06cc\u0627\u06d4<\/p>\n<pre><code class=\"language-bash\">opa test . --coverage --format json | jq '{overall: .coverage}'\n<\/code><\/pre>\n<pre><code class=\"language-plaintext\">{\n  \"overall\": 100\n}\n<\/code><\/pre>\n<p><strong>\u0633\u0627\u062f\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u06d2 100% \u06a9\u0648\u0631\u06cc\u062c \u0631\u06cc\u06a9\u0627\u0631\u0688 \u06a9\u06cc\u060c 2 \u0645\u06cc\u06ba \u0633\u06d2 2 \u0679\u06cc\u0633\u0679 \u067e\u0627\u0633 \u06a9\u06cc\u06d2\u060c \u0627\u0648\u0631 \u0628\u063a\u06cc\u0631 \u06a9\u0633\u06cc \u0679\u06cc\u06af \u06a9\u06d2 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0636\u0627\u0626\u0639 \u06a9\u0631 \u062f\u06cc\u0627\u06d4<\/strong><\/p>\n<p>\u06a9\u0648\u0631\u06cc\u062c \u067e\u06cc\u0645\u0627\u0626\u0634 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u06a9\u0648\u0646 \u0633\u06cc \u0644\u0627\u0626\u0646 \u0679\u06cc\u0633\u0679 \u067e\u0631 \u0639\u0645\u0644 \u062f\u0631\u0622\u0645\u062f \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0622\u067e \u06a9\u0648 \u063a\u06cc\u0631 \u0645\u062a\u0648\u0642\u0639 \u0627\u0646 \u067e\u0679 \u0634\u06a9\u0644\u0648\u06ba \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u0628\u062a\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648\u0688\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u06cc\u06c1 \u0645\u06a9\u0645\u0644 \u0646\u0627\u06a9\u0627\u0645\u06cc \u06a9\u0627 \u0645\u0648\u0688 \u06c1\u06d2\u06d4 \u06a9\u0648\u0631\u06cc\u062c \u0631\u067e\u0648\u0631\u0679\u0646\u06af \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0633 \u0628\u0627\u062a \u06a9\u0627 \u062b\u0628\u0648\u062a \u06c1\u06d2 \u06a9\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0627\u0635\u0644 \u0645\u06cc\u06ba \u06a9\u0627\u0645 \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u0627\u0633\u06d2 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0688\u06be\u0627\u0646\u0686\u06d2 \u067e\u0631 \u0686\u0644\u0627\u0646\u06d2 \u0633\u06d2 \u062d\u0627\u0635\u0644 \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u062c\u0633 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0622\u067e \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u0627\u06d4<\/p>\n<h2 id=\"heading-limits-of-the-check\">\u0686\u06cc\u06a9 \u06a9\u06cc \u062d\u062f<\/h2>\n<p>\u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u062c\u06be\u0648\u0679\u06cc \u0627\u062c\u0627\u0632\u062a\u06cc\u06ba \u06a9\u06cc\u0686\u0632 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0627\u06c1\u0645 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u06cc\u06c1 \u06af\u06cc\u0679 \u0627\u0628 \u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u0627:<\/p>\n<h3 id=\"heading-1-unknown-values-are-invisible\">1. \u0646\u0627\u0645\u0639\u0644\u0648\u0645 \u0642\u062f\u0631\u06cc\u06ba \u0646\u0638\u0631 \u0646\u06c1\u06cc\u06ba \u0622\u062a\u06cc\u06ba\u06d4<\/h3>\n<p>Terraform \u06a9\u0633\u06cc \u0628\u06be\u06cc \u0627\u06cc\u0633\u06cc \u0686\u06cc\u0632 \u06a9\u0648 \u0646\u0634\u0627\u0646 \u0632\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0633\u06d2 \u0644\u0627\u06af\u0648 \u0648\u0642\u062a \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0646\u0627\u0645\u0639\u0644\u0648\u0645 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u062d\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u06d4 <code>null<\/code> \u067e\u0644\u0627\u0646 JSON \u0633\u06d2 <code>after_unknown<\/code> \u0646\u0642\u0634\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u067e\u0691\u06be\u06cc\u06ba <code>change.after.some_field<\/code> \u0627\u06af\u0631 \u0641\u06cc\u0644\u0688 \u0646\u0627\u0645\u0639\u0644\u0648\u0645 \u06c1\u06d2 \u062a\u0648 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u0686\u0644\u06d2 \u06af\u0627\u06d4<\/p>\n<p>\u06a9\u0631\u0627\u0633 \u0631\u06cc\u0633\u0648\u0631\u0633 \u0631\u0648\u0644\u0632 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06cc\u06c1 \u0633\u0628 \u0633\u06d2 \u0628\u0691\u0627 \u0645\u0633\u0626\u0644\u06c1 \u06c1\u06d2\u060c \u062c\u06c1\u0627\u06ba \"\u062a\u0645\u0627\u0645 \u0628\u0627\u0644\u0679\u06cc\u0648\u06ba \u0645\u06cc\u06ba \u0639\u0648\u0627\u0645\u06cc \u0631\u0633\u0627\u0626\u06cc \u06a9\u06d2 \u0628\u0644\u0627\u06a9\u0633 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\" \u0645\u0646\u0635\u0648\u0628\u06c1 \u0628\u0646\u062f\u06cc \u06a9\u06d2 \u0648\u0642\u062a \u0648\u0627\u0642\u0639\u06cc \u0645\u0634\u06a9\u0644 \u06c1\u06d2\u060c \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0628\u0644\u0627\u06a9\u0633 \u0639\u0627\u0645 \u0637\u0648\u0631 \u067e\u0631 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06c1\u0648\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0628\u0627\u0644\u0679\u06cc \u0622\u0626\u06cc \u0688\u06cc\u0632 \u06a9\u0627 \u062d\u0648\u0627\u0644\u06c1 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>(known after apply)<\/code>.<\/p>\n<h3 id=\"heading-2-it-sees-the-plan-and-only-the-plan\">2. \u0635\u0631\u0641 \u067e\u0644\u0627\u0646 \u06a9\u0648 \u062f\u06cc\u06a9\u06be\u06cc\u06ba\u06d4 \u0645\u06cc\u06ba \u0635\u0631\u0641 \u0645\u0646\u0635\u0648\u0628\u06c1 \u062f\u06cc\u06a9\u06be \u0631\u06c1\u0627 \u06c1\u0648\u06ba\u06d4<\/h3>\n<p>\u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0686\u06cc\u0632 \u062c\u0648 \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u06a9\u06d2 \u0628\u0627\u06c1\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u06a9\u0646\u0633\u0648\u0644 \u0645\u06cc\u06ba \u062a\u0628\u062f\u06cc\u0644 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u06cc\u0627 \u062a\u062e\u0644\u06cc\u0642 \u06a9\u06d2 \u067e\u0648\u0634\u06cc\u062f\u06c1 \u06c1\u0648\u0646\u06d2 \u06a9\u06d2 \u0628\u0639\u062f \u0633\u06d2 \u0686\u0644\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u0645\u0646\u0635\u0648\u0628\u06c1 \u0628\u0646\u062f\u06cc \u06a9\u06d2 \u0648\u0642\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0627\u0648\u0631 \u062f\u0627\u062e\u0644\u06d2 \u06a9\u06d2 \u0648\u0642\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06c1\u06d2\u06d4 <em>\u0645\u062e\u062a\u0644\u0641<\/em> \u0622\u067e\u0631\u06cc\u0634\u0646 \u06a9\u0648 \u0648\u0642\u0641\u06d2 \u0648\u0642\u0641\u06d2 \u0633\u06d2 \u0646\u0627\u0628\u06cc\u0646\u0627 \u062c\u06af\u06c1 \u0627\u0648\u0631 \u0627\u0633 \u062d\u0627\u0644\u062a \u06a9\u0627 \u0645\u0639\u0627\u0626\u0646\u06c1 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062e\u062a\u0645 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u062c\u0633 \u0645\u06cc\u06ba \u062f\u0648\u0646\u0648\u06ba \u0631\u06a9\u06be\u06d2 \u06af\u0626\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-3-coverage-of-controls-isnt-measurable-from-inside\">3. \u06a9\u0646\u0679\u0631\u0648\u0644 \u06a9\u06cc \u0645\u062f\u062a \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0645\u0627\u067e\u0627 \u0646\u06c1\u06cc\u06ba \u062c\u0627 \u0633\u06a9\u062a\u0627.<\/h3>\n<p>100 \u06af\u0631\u06cc\u0646 \u0686\u06cc\u06a9 \u0642\u0648\u0627\u0639\u062f \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u06a9\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u0633\u06cc \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u0627 \u06c1\u06d2\u06d4 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u06a9\u0646\u0679\u0631\u0648\u0644 \u06a9\u06cc \u0636\u0631\u0648\u0631\u06cc\u0627\u062a \u0627\u0648\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0641\u0627\u0626\u0644\u0648\u06ba \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0646\u0642\u0634\u06c1 \u062c\u0627\u062a \u06a9\u0648 \u0628\u0631\u0642\u0631\u0627\u0631 \u0631\u06a9\u06be\u06cc\u06ba \u0627\u0648\u0631 \u0634\u06cc\u0688\u0648\u0644 \u06a9\u06d2 \u0645\u0637\u0627\u0628\u0642 \u0627\u0646 \u06a9\u0627 \u0622\u0688\u0679 \u06a9\u0631\u06cc\u06ba\u06d4 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06af\u06cc\u0679 \u0646\u06c1\u06cc\u06ba \u062c\u0627\u0646 \u0633\u06a9\u062a\u0627 \u06a9\u06c1 \u06a9\u06cc\u0627 \u0645\u0627\u0646\u06af\u0627 \u0646\u06c1\u06cc\u06ba \u062c\u0627\u062a\u0627\u06d4<\/p>\n<h3 id=\"heading-4-the-cidr-list-is-an-exact-match\">4. CIDR \u0641\u06c1\u0631\u0633\u062a \u0628\u0627\u0644\u06a9\u0644 \u0645\u0645\u0627\u062b\u0644 \u06c1\u06d2\u06d4<\/h3>\n<p><code>public_cidrs<\/code>    \u0642\u0628\u0636\u06c1 <code>0.0.0.0\/0<\/code> \u0627\u0648\u0631 <code>::\/0<\/code> \u0627\u0633 \u06a9\u06d2 \u0639\u0644\u0627\u0648\u06c1 \u0627\u0648\u0631 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba\u06d4 \u0642\u0648\u0627\u0639\u062f \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>0.0.0.0\/1<\/code> \u0627\u0646\u0679\u0631\u0646\u06cc\u0679 \u062a\u06a9 \u067e\u06c1\u0646\u0686\u06cc\u06ba \u0627\u0648\u0631 \u0622\u062f\u06be\u06d2 \u0631\u0627\u0633\u062a\u06d2 \u0633\u06d2 \u06af\u0632\u0631\u06cc\u06ba\u06d4 \u0627\u0633 \u0645\u06cc\u06ba \u062a\u0648\u0633\u06cc\u0639 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u0641\u06cc\u0635\u0644\u06c1 \u06a9\u0631\u0646\u0627 \u06a9\u06c1 \u06a9\u0648\u0646 \u0633\u06d2 \u0633\u0627\u0628\u0642\u06c1 \u200b\u200b\u06a9\u06cc \u0644\u0645\u0628\u0627\u0626\u06cc \u06a9\u0648 \u0639\u0648\u0627\u0645\u06cc \u0633\u0645\u062c\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 RFC 1918 \u0627\u0633\u067e\u06cc\u0633 \u06a9\u0648 \u062a\u0642\u0633\u06cc\u0645 \u06a9\u0631\u0646\u0627\u060c \u0627\u0648\u0631 \u06cc\u06c1 \u0641\u06cc\u0635\u0644\u06c1 \u062a\u0646\u0638\u06cc\u0645 \u06a9\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-5-four-shapes-is-what-i-found\">5. \u0645\u06cc\u06ba \u0646\u06d2 \u062c\u0648 \u067e\u0627\u06cc\u0627 \u0648\u06c1 \u0686\u0627\u0631 \u0634\u06a9\u0644\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4<\/h3>\n<p>\u06a9\u06c1 <code>exposures<\/code> \u0633\u06cc\u0679 \u0645\u06cc\u06ba \u0648\u06c1 \u0686\u0627\u0631 \u0627\u0646\u06a9\u0648\u0688\u0646\u06af\u0632 \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba \u062c\u0646 \u06a9\u06cc \u0645\u06cc\u06ba \u062a\u0644\u0627\u0634 \u06a9\u0631 \u0631\u06c1\u0627 \u062a\u06be\u0627\u060c \u0627\u0648\u0631 AWS \u0627\u0648\u0631 \u0628\u06be\u06cc \u0628\u06c1\u062a \u06a9\u0686\u06be \u067e\u06cc\u0634 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u06a9\u0627 \u062d\u0648\u0627\u0644\u06c1 (<code>security_groups<\/code>)\u060c \u0633\u0627\u0628\u0642\u06c1 \u200b\u200b\u0641\u06c1\u0631\u0633\u062a\u060c \u0627\u0648\u0631 <code>self<\/code> \u0627\u06cc\u06a9 \u0642\u0627\u0639\u062f\u06c1 \u06a9\u0633\u06cc \u0628\u0646\u062f\u0631\u06af\u0627\u06c1 \u062a\u06a9 \u067e\u06c1\u0646\u0686\u0646\u06d2 \u06a9\u0627 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0637\u0631\u06cc\u0642\u06c1 \u06c1\u06d2 \u062c\u0633\u06d2 \u06cc\u06c1 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0645\u0627\u0688\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u062f\u06cc\u06a9\u06be\u06d2 \u06af\u06cc\u06d4 \u0645\u06cc\u06ba \u067e\u0627\u0646\u0686\u0648\u06cc\u06ba \u0634\u06a9\u0644 \u062f\u06cc\u06a9\u06be\u0646\u06d2 \u06a9\u06cc \u062a\u0648\u0642\u0639 \u06a9\u0631\u062a\u0627 \u06c1\u0648\u06ba \u062c\u0628 \u06cc\u06c1 \u067e\u06c1\u0644\u06cc \u0628\u0627\u0631 \u0628\u0691\u06cc \u062c\u0627\u0626\u06cc\u062f\u0627\u062f\u0648\u06ba \u06a9\u06d2 \u062e\u0644\u0627\u0641 \u0686\u0644\u0627\u0626\u06cc \u062c\u0627\u0626\u06d2 \u06af\u06cc\u06d4<\/p>\n<h3 id=\"heading-6-regulatory-dates-move\">6. \u0631\u06cc\u06af\u0648\u0644\u06cc\u0679\u0631\u06cc \u062a\u0627\u0631\u06cc\u062e\u0648\u06ba \u06a9\u0648 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u0646\u0627<\/h3>\n<p>\u0627\u06af\u0631 \u06c1\u0645 EU AI \u0642\u0627\u0646\u0648\u0646 \u06a9\u06cc \u0637\u0631\u0641 \u0628\u0691\u06be \u0631\u06c1\u06d2 \u06c1\u06cc\u06ba \u062a\u0648\u060c \u062c\u0648\u0644\u0627\u0626\u06cc 2026 \u0645\u06cc\u06ba \u0627\u0639\u0644\u0627\u0646 \u06a9\u0631\u062f\u06c1 \u0688\u06cc\u062c\u06cc\u0679\u0644 Omnibus 2 \u0627\u06af\u0633\u062a 2026 \u0633\u06d2 Annex III \u06c1\u0627\u0626\u06cc \u0631\u0633\u06a9 \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc\u0627\u06ba \u0645\u062a\u0639\u0627\u0631\u0641 \u06a9\u0631\u0627\u0626\u06d2 \u06af\u0627\u06d4 <strong>2 \u062f\u0633\u0645\u0628\u0631 2027<\/strong>\u0627\u0648\u0631 \u0636\u0645\u06cc\u0645\u06c1 I \u06a9\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc\u0627\u06ba 2 \u0627\u06af\u0633\u062a 2028 \u062a\u06a9 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u062c\u0628\u06a9\u06c1 \u0622\u0631\u0679\u06cc\u06a9\u0644 50 \u0634\u0641\u0627\u0641\u06cc\u062a \u06a9\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc 2 \u0627\u06af\u0633\u062a 2026 \u06a9\u06cc \u0627\u067e\u0646\u06cc \u0627\u0635\u0644 \u062a\u0627\u0631\u06cc\u062e \u06a9\u0648 \u0628\u0631\u0642\u0631\u0627\u0631 \u0631\u06a9\u06be\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u067e\u0646\u06d2 \u06a9\u0646\u0679\u0631\u0648\u0644\u0632 \u06a9\u0648 \u0627\u0646\u06a9\u0648\u0688 \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u062c\u0628 \u0628\u06be\u06cc \u0622\u067e \u06a9\u0648 \u0627\u0646 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648 \u0633\u0631\u06a9\u0627\u0631\u06cc \u0679\u0627\u0626\u0645 \u0644\u0627\u0626\u0646 \u0645\u06cc\u06ba \u062a\u0627\u0631\u06cc\u062e\u06cc\u06ba \u062f\u06cc\u06a9\u06be\u06cc\u06ba\u06d4 \u0627\u0633 \u0645\u06cc\u06ba \u0627\u06cc\u0633\u06d2 \u0645\u0639\u0627\u0645\u0644\u0627\u062a \u0628\u06be\u06cc \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u067e\u0686\u06be\u0644\u06cc \u0633\u06c1 \u0645\u0627\u06c1\u06cc\u0648\u06ba \u06a9\u06cc \u0628\u0644\u0627\u06af \u067e\u0648\u0633\u0679\u0633 (\u0628\u0634\u0645\u0648\u0644 \u06cc\u06c1) \u062f\u0648\u0633\u0631\u06cc \u0635\u0648\u0631\u062a \u0645\u06cc\u06ba \u0628\u06cc\u0627\u0646 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-conclusion\">\u0646\u062a\u06cc\u062c\u06c1<\/h2>\n<p>\u06cc\u06c1 \u0645\u0627\u0688\u0644 \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u06a9\u0648\u0688 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u06c1\u0631 \u0628\u0627\u0631 \u067e\u0627\u0631\u0633 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 56% \u0645\u062d\u0641\u0648\u0638 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u06a9\u0633\u06cc \u0633\u06d2 \u0628\u06be\u06cc \u0632\u06cc\u0627\u062f\u06c1 \u062a\u06cc\u0632\u06cc \u0633\u06d2 \u067e\u06c1\u0646\u0686\u062a\u0627 \u06c1\u06d2\u06d4 \u062f\u0633\u062a\u06cc \u062c\u0627\u0626\u0632\u06c1 \u0646\u06d2 \u062e\u0644\u0627 \u0645\u06cc\u06ba \u06a9\u06c1\u06cc\u06ba \u062d\u0642\u06cc\u0642\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 \u06a9\u06be\u0648 \u062f\u06cc\u0627\u06d4 \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u0627 \u0645\u0642\u0635\u062f \u06c1\u0645\u06cc\u0634\u06c1 \u0642\u0627\u0628\u0644 \u0639\u0645\u0644 \u06c1\u0648\u0646\u0627 \u062a\u06be\u0627 \u0627\u0648\u0631 \u062d\u062c\u0645 \u062e\u062a\u0645 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u0645\u0633\u0627\u0626\u0644 \u067e\u06cc\u062f\u0627 \u06c1\u0648\u0626\u06d2\u06d4<\/p>\n<p>\u0627\u0633 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644 \u0645\u06cc\u06ba \u0622\u067e \u06a9\u0631\u06cc\u06ba \u06af\u06d2:<\/p>\n<ul>\n<li>\n<p>\u06a9\u0645\u0679 \u067e\u0631\u060c \u0627\u0635\u0644 \u06a9\u0645\u0632\u0648\u0631 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e TerraGoat \u0633\u06d2 \u062f\u0631\u0622\u0645\u062f \u06a9\u06cc\u06d2 \u06af\u0626\u06d2 \u062a\u06be\u06d2\u06d4 <code>729f8da<\/code> \u0679\u06cc\u0631\u0627\u0641\u0627\u0631\u0645 1.14.2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u0646\u0635\u0648\u0628\u06c1 \u0628\u0646\u0627\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>20 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0679\u06cc\u0633\u0679 \u0644\u06a9\u06be \u06a9\u0631 OPA 1.20.2 \u067e\u0627\u0633 \u06a9\u06cc\u0627 \u062c\u0633 \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u062f\u0627\u062e\u0644\u06cc \u0627\u0635\u0648\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0686\u0627\u0631 Terraform \u0627\u0646\u06a9\u0648\u0688\u0646\u06af\u0632 \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u06c1\u0645\u06cc\u06ba TerraGoat \u067e\u0644\u0627\u0646 \u0645\u06cc\u06ba \u0633\u0627\u062a \u062d\u0642\u06cc\u0642\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0627\u06ba \u0645\u0644\u06cc\u06ba\u060c \u067e\u0648\u0631\u0679 80 \u06a9\u0648 \u062f\u0631\u0633\u062a \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u0646\u0638\u0631 \u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062c\u0628 \u0645\u06cc\u06ba \u0646\u06d2 \u06a9\u0686\u06be \u062a\u062d\u0642\u06cc\u0642 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc \u062a\u0648 \u0645\u06cc\u06ba \u0646\u06d2 4-\u0641\u06cc\u0635\u0644\u06d2 \u0648\u0627\u0644\u06d2 \u0645\u0639\u0627\u06c1\u062f\u06d2 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u06a9 \u06af\u06cc\u0679 \u0628\u0646\u0627\u06cc\u0627 \u062c\u0648 2 \u0628\u0627\u0631 \u0628\u0627\u06c1\u0631 \u0686\u0644\u0627 \u06af\u06cc\u0627\u06d4<\/p>\n<\/li>\n<li>\n<p>\u06c1\u0645 \u0646\u06d2 100% \u0679\u06cc\u0633\u0679 \u06a9\u0648\u0631\u06cc\u062c \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0633\u0627\u062f\u06c1 \u0648\u0631\u0698\u0646 \u06a9\u0648 9 \u0645\u06cc\u06ba \u0633\u06d2 4 \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0648\u06ba \u06a9\u0648 \u062f\u06cc\u06a9\u06be\u0627\u060c \u0627\u0648\u0631 \u067e\u06be\u0631 \u0627\u0633\u06d2 \u0628\u0691\u06be\u0627 \u06a9\u0631 9 \u0645\u06cc\u06ba \u0633\u06d2 9 \u06a9\u0648 \u062a\u0644\u0627\u0634 \u06a9\u06cc\u0627\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 \u062a\u062e\u0644\u06cc\u0642 \u0644\u0648\u067e \u06a9\u0648 \u062c\u0648\u0691 \u062f\u06cc\u0627 \u06c1\u06d2\u06d4 <code>opa check<\/code> \u0627\u0648\u0631 \u0688\u0633\u06a9 \u067e\u0631 \u06a9\u06cc\u0627 \u062e\u062a\u0645 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u0627\u0633 \u06a9\u0627 \u062a\u0639\u06cc\u0646 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u067e\u0646\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0648\u06c1\u06cc \u0627\u0646\u062c\u0646 \u0645\u062c\u0627\u0632 \u0627\u06cc\u062c\u0646\u0679 \u0679\u0648\u0644 \u06a9\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0633 \u0645\u06cc\u06ba \u0631\u062f \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 15 \u0679\u06cc\u0633\u0679 \u0627\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679\u0633 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<\/ul>\n<p>\u0645\u06cc\u0631\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u06d2 \u0627\u0646 \u06a9\u06cc\u0633\u0648\u06ba \u06a9\u0648 \u0633\u0646\u0628\u06be\u0627\u0644\u0627 \u062c\u0646 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0645\u06cc\u06ba \u0646\u06d2 \u0644\u06a9\u06be\u0627 \u062a\u06be\u0627\u060c \u0627\u06cc\u06a9 \u062c\u0648\u0691\u06d2 \u06a9\u0648 \u06cc\u0627\u062f \u06a9\u06cc\u0627 \u062c\u0633 \u06a9\u0627 \u0645\u06cc\u06ba \u0646\u06d2 \u06a9\u0628\u06be\u06cc \u062a\u0635\u0648\u0631 \u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062a\u06be\u0627\u060c \u0627\u0648\u0631 \u0645\u062c\u06be\u06d2 \u0648\u06c1 \u062a\u0645\u0627\u0645 \u0646\u0634\u0627\u0646\u0627\u062a \u062f\u06cc\u06d2 \u062c\u0648 \u0627\u0633 \u0646\u06d2 \u0645\u062c\u06be\u06d2 \u062f\u06cc\u0626\u06d2 \u062a\u06be\u06d2 (\u0679\u06cc\u0633\u0679 \u067e\u0627\u0633 \u06c1\u0648\u0627\u060c 100% \u06a9\u0648\u0631\u06cc\u062c\u060c \u0627\u0648\u0631 \u0635\u0627\u0641 <code>opa check<\/code>) \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u062a\u0641\u0627\u0642 \u06a9\u06cc\u0627 \u06a9\u06c1 \u06cc\u06c1 \u0679\u06be\u06cc\u06a9 \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u0686\u06cc\u0632 \u062c\u0633 \u0633\u06d2 \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u062e\u062a\u0644\u0627\u0641 \u06a9\u06cc\u0627 \u0648\u06c1 \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u062a\u06be\u0627 \u062c\u0648 \u06a9\u0633\u06cc \u0627\u0648\u0631 \u0646\u06d2 \u0644\u06a9\u06be\u0627 \u062a\u06be\u0627\u06d4 \u0627\u067e\u0646\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0627\u0628\u062a\u062f\u0627\u0626\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0627\u0633 \u06a9\u0648\u0688 \u067e\u0631 \u0628\u06cc\u0627\u0646 \u06a9\u0631\u06cc\u06ba \u062c\u0633\u06d2 \u0622\u067e \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u0627 \u0627\u0648\u0631 \u0627\u0633\u06d2 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u0628\u0686\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u0633\u06a9\u0631\u067e\u0679 \u062c\u0648 \u062a\u0645\u0627\u0645 \u06a9\u0648\u0688\u060c \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba\u060c \u067e\u0644\u0627\u0646 JSON \u0627\u0648\u0631 \u062a\u0635\u0627\u0648\u06cc\u0631 \u0644\u06a9\u06be\u062a\u06cc \u06c1\u06d2\u06d4 <code>code\/<\/code> \u0627\u0633 \u06c1\u06cc\u0646\u0688 \u0628\u06a9 \u06a9\u06d2 \u0622\u06af\u06d2 \u0688\u0627\u0626\u0631\u06cc\u06a9\u0679\u0631\u06cc\u06d4 \u0627\u0639\u062f\u0627\u062f \u0648 \u0634\u0645\u0627\u0631 \u06a9\u0648 \u0645\u0646\u062f\u0631\u062c\u06c1 \u0630\u06cc\u0644 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u062f\u0648\u0628\u0627\u0631\u06c1 \u067e\u06cc\u0634 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2: <code>python3 build\/make_images.py<\/code> \u0627\u0648\u0631 <code>python3 build\/make_terminals.py<\/code>. \u0679\u0631\u0645\u06cc\u0646\u0644 \u0627\u0633\u06a9\u0631\u06cc\u0646 \u0634\u0627\u0679\u0633 \u0633\u0686\u0627\u0626\u06cc \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0648\u06c1 \u062a\u0639\u0645\u06cc\u0631\u0627\u062a\u06cc \u0648\u0642\u062a \u067e\u0631 \u06a9\u0645\u0627\u0646\u0688\u0632 \u06a9\u0648 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0686\u0644\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u062c\u062f\u06cc\u062f \u062a\u0631\u06cc\u0646 \u0645\u0627\u0688\u0644 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 100% \u0646\u062d\u0648\u06cc \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u0633\u062a \u06a9\u0648\u0688 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0648\u06cc\u0631\u0627 \u06a9\u0648\u0688 \u06a9\u06cc 2026 \u06a9\u06cc \u0631\u067e\u0648\u0631\u0679 \u0645\u06cc\u06ba \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u06a9\u06c1\u0627 \u06af\u06cc\u0627 \u06c1\u06d2 \u06a9\u06c1 &quot;\u0646\u062d\u0648 \u06a9\u0648 \u0645\u0624\u062b\u0631 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u062d\u0644 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4&#8221; \u06cc\u06c1 \u0627\u06cc\u06a9 \u0633\u0646\u06af \u0645\u06cc\u0644 \u06a9\u06cc \u0637\u0631\u062d \u0644\u06af\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u06cc\u06c1\u0627\u06ba \u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0645\u0633\u0626\u0644\u06c1 \u06c1\u06d2. \u0627\u0633\u06cc \u0631\u067e\u0648\u0631\u0679 \u0645\u06cc\u06ba 100 \u0633\u06d2 [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":30183,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-30182","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/30182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/comments?post=30182"}],"version-history":[{"count":1,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/30182\/revisions"}],"predecessor-version":[{"id":30184,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/30182\/revisions\/30184"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/media\/30183"}],"wp:attachment":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/media?parent=30182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/categories?post=30182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/tags?post=30182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}