init

.github/workflows/audit.yml

@@ -0,0 +1,30 @@
+name: audit
+on:
+  workflow_dispatch:
+  push:
+  # schedule:
+  # - cron: "30 17 1 * *"
+  # - cron:  '30 5,17 * * *'
+
+jobs:
+  list-instances:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Set up AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ap-northeast-1
+
+      - name: Dump instances
+        run: mkdir -p instances && aws ec2 describe-instances > instances/data.json
+      - name: Dump security groups
+        run: mkdir -p security_groups && aws ec2 describe-security-groups > security_groups/data.json
+      - uses: docker://openpolicyagent/opa:0.55.0
+        with:
+          args: "eval -f pretty -b ./ --fail-defined data.ex6.failed"

policy.rego

@@ -0,0 +1,2 @@
+package ex6
+