--fail-defined Flag always Exits with Failure

[jladams145]

Hello all, I am just starting getting into Rego and OPA and had a quick question. I am attempting to create an automation pipeline that checks OPA policies against our IaC for Terraform and hit a bit of a snag that I can't seem to find any good documentation on. I just updated to the latest OPA/Rego versions and have been running both:

opa eval and opa exec and gotten decent results.

However, when I add the --fail-defined flag it will always exit with a failure. This is my exec command and its output:
opa exec --decision azure/policy --bundle ./ tfplans/tfplan.json --fail-defined

{
  "result": [
    {
      "path": "tfplans/tfplan.json",
      "result": {
        "check": {
          "deny": []
        }
      }
    }
  ]
}
{"err":"exec error: there were 1 failures and 0 errors counted in the results list, and --fail-defined is set","level":"error","msg":"Unexpected error.","time":"2025-01-07T09:26:06-06:00"}

The following opa eval gives this results:
opa eval --bundle ./ --input tfplans/tfplan2.json "data.terraform.azure.library.eval_output" --fail-defined

{
  "result": [
    {
      "expressions": [
        {
          "value": [],
          "text": "data.terraform.azure.library.eval_output",
          "location": {
            "row": 1,
            "col": 1
          }
        }
      ]
    }
  ]
}

I've scoured the forums, issues and google but to no avail. Not sure why its constantly getting an error but the debug is clean and without the --fail-defined flag it seems to execute just fine. Any help would be great.

[srenatus]

It looks like your decision, azure/policy, which corresponds to data.azure.policy, evaluates to something defined, namely

{
        "check": {
          "deny": []
        }
}

So perhaps you should try evaluating data.azure.policy.check.deny, i.e. azure/policy/check/deny (educated guess), or even terraform/azure/library/eval_output?

[jladams145]

Though I think you are probably on the right track that I am messing something up with the syntax of the query both of those suggestions have basically just cleaned up the JSON object that is being returned but still causes an exit with code 1 as I am still getting some random error. Maybe providing the actual setup of my project could help.

I currently have a project that looks like this:

└── 📁terraform-azure-opa-library
    └── 📁policies
        └── 📁azurerm_storage_account
            └── allow_public_access.rego
            └── valid_format.rego
        └── 📁azurerm_virtual_network
            └── azurerm_allowed_vnets.rego
    └── 📁tfplans
        └── tfplan.json
        └── tfplan2.json
        └── tfplantest.json
    └── 📁workspaces
        └── opa_library.rego

The opa_library.rego looks like this:

package terraform.azure.library

import rego.v1
# Helper function to check if a storage account allows public access
is_public_network_access_enabled(values) = true if {
    values.public_network_access_enabled == true
}

is_valid_value(resource) = true if {
    resource.format_version >= "1.2"
}

is_vnet_allowed(resource) = true if {
    allowed_vnet_names = {"vnet1", "vnet2"}
    resource.name == allowed_vnet_names[_]
}

eval_output := out if {
    out := data.azure.policy.check.deny
}

I'll just put the storage account rego in here to save space:

package azure.policy.check

import rego.v1
import data.terraform.azure.library.is_public_network_access_enabled

# Define the rule that denies public access to the storage account
deny contains msg if {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "azurerm_storage_account"
    is_public_network_access_enabled(resource.values)
    msg := sprintf("Storage account '%s' allows public access. Public network access should be disabled.", [resource.values.name])
}

Since it may be relevant - all my files are in package azure.policy.check so they can be called together and have the same deny type rules with messages.

So essentially I am trying to get this to to check all those policies against my Terraform JSON and if any are true, return those to the console. But even when they aren't true and all checks out - the error persists if I use --fail-defined and I genuinely think its because I am misunderstanding something.

Error when evaluating the eval_output which checks each deny:
{"err":"exec error: there were 1 failures and 0 errors counted in the results list, and --fail-defined is set","level":"error","msg":"Unexpected error.","time":"2025-01-07T15:21:52-06:00"}

[srenatus]

Could it be that you evaluate a multi-value rule (deny)? You could try using --fail-non-empty instead, because multi-value rules are never undefined, but they might be empty sets.

[jladams145]

This was exactly what I was looking for! Thank you. This has solved my issue.