使用 AWS CDK 结合 OPA 实现“策略即代码”

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"italic"}],"text":"Original URL:"},{"type":"text","text":" "},{"type":"link","attrs":{"href":"https:\/\/aws.amazon.com\/blogs\/opensource\/realize-policy-as-code-with-aws-cloud-development-kit-through-open-policy-agent\/","title":"","type":null},"content":[{"type":"text","marks":[{"type":"italic"}],"text":"https:\/\/aws.amazon.com\/blogs\/opensource\/realize-policy-as-code-with-aws-cloud-development-kit-through-open-policy-agent\/"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/docs.aws.amazon.com\/cdk\/latest\/guide\/home.html","title":"","type":null},"content":[{"type":"text","text":"AWS Cloud Development Kit"}]},{"type":"text","text":"（AWS CDK）是一个开源软件框架，允许使用熟悉的编程语言来定义和配置AWS上的基础设施。“基础设施即代码”通过使用CDK对基础设施进行版本控制，能够更有效且可靠地管理AWS上的基础设施。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"当然，在计划部署新的AWS资源或更新时，我们必须确保这些更改没有引入安全漏洞，势必要建立安全合规基准，辅以流程遵循合规性要求。现在，是时候来设置和定义相应的安全基准，以确保AWS上基础设施的更改不会引起安全问题。"},{"type":"link","attrs":{"href":"https:\/\/www.openpolicyagent.org\/","title":"","type":null},"content":[{"type":"text","text":"开放策略代理"}]},{"type":"text","text":"（OPA）是一个云原生基金会的孵化项目，旨在针对云上基础设施的安全基准策略自动进行检查。OPA提供了统一的框架和语言，用于声明、实施和控制云上基础设施中各个部件的安全基准策略。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"将OPA与AWS CDK集成在一起之后，可获得“策略即代码”的能力，即在AWS CDK对AWS环境进行更改之前，对这些更改进行合规策略的检查。这种新方法带来很多好处，具体包括："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"各个团队成员可以轻松在实际更改之前进行策略检查。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过与CI \/ CD集成，可以自动执行策略检查。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用户可以对“基础设施即代码”实施强制性检查。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用户可以根据行业最佳实践框架（例如CIS AWS Benchmark）中的安全合规要求，编写自定义的OPA策略。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"总而言之，这将极大地缩短基础设施安全合规的事后检查周期。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"这篇文章的其余部分将逐步介绍如何将OPA与AWS CDK结合使用，以实现“策略即代码”。这将涉及以下的任务："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"创建一个AWS CDK项目以部署AWS资源。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"根据REGO策略语言编写简单的OPA策略。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"利用OPA策略来检查AWS CDK的基础设施代码。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"先决条件"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"1.1 在AWS Cloud9中创建EC2环境"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}