Releases · forseti-security/resource-policy-evaluation-library

This release includes a number of breaking changes. It includes a redesign of the OPA Policy Engine policy format, and the GoogleAPIResource classes.

Policy Engine changes

A dataclass has been added for evaluations rpe.policy.Evaluations, which includes references to the poilcy engine and the resource.
Policy engines now have an evaluate(resource) function which returns a list of rpe.policy.Evaluations
Each evaluation has its own remediate() function
An ABC was created for engines rpe.engines.Engine

The valid rule has been renamed complaint
The valid/compliant no longer passes for exclusions
The excluded rule has been added so we can now determine whether something is compliant separately from whether or not its excluded
All remediations use the remediation_spec instead of the older update solution
All policies are in a single namespace, and define an applies_to list of resource types, checked against input.type for evaluations
A single entrypoint handles evaluations of applicable policies, by type /v1/data/rpe/evaluate

A single class now retrieves both the resource metadata and the IAM policy where applicable
The GoogleAPIResource.factory method was replaced with GoogleAPIResource.from_resource_data
All resource types have been updated to use the format that Cloud Asset Inventory uses (our early custom resource types have been removed)