updated plan.yml

.github/workflows/plan.yml

@@ -46,9 +46,20 @@ jobs:
     - name: Terraform Format
       run: terraform fmt -check
 
-    # Generates an execution plan for Terraform
+      # Terraform Plan
     - name: Terraform Plan
-      run: terraform plan -input=false
+      id: plan
+      run: |
+        terraform plan -out=plan.tfplan
+        terraform show -json plan.tfplan > /tmp/plan.json
+        cat /tmp/plan.json
 
-    - name: View Terraform Plan
-      run: terraform plan -no-color -json
+    - name: Setup OPA
+      uses: open-policy-agent/setup-opa@v2
+      with:
+        version: latest
+
+    - name: Run OPA Tests
+      run: |
+        opaout=$(opa eval --data ../policies/plan.rego --input /tmp/plan.json "data.terraform.deny" | jq -r '.result[].expressions[].value[]')
+        [ -z "$opaout" ] && exit 0 || echo "$opaout" && gh pr comment ${{ github.event.pull_request.number }} --body "### $opaout" && exit 1

policies/plan.rego

@@ -0,0 +1,13 @@
+package terraform
+
+import future.keywords.in
+
+allowed_instance_types := {"t3.micro", "t3.small"}
+
+deny[msg] {
+  some resource in input.resource_changes
+  resource.type == "aws_instance"
+  instance_type := resource.change.after.instance_type
+  not instance_type in allowed_instance_types
+  msg := sprintf("AWS instance type '%s' is not allowed. Only 't3.micro' or 't3.small' are permitted.", [instance_type])
+}