Search code examples
policyopen-policy-agentrego

Pass back a value from Open Policy Agent (OPA) query

Instead of seeing who can access what, I want to setup policies that return how many connections are allowed per second, or, how much bandwidth is allowed. How do I define my policies to return values instead of true/false?

Solution

  • Complete rules are just if-then statements that assign a VALUE to a VARIABLE. When the VALUE is omitted, it's implicitly true:

    allow { input.method == "GET" }

    Is equivalent to:

    allow = true { input.method == "GET" }

    There is nothing special about allow or true though; you could similarly define a rule that sets the connections per second limit:

    connections_per_second = 7 { input.tier == "gold" }

    If you have multiple definitions just be aware that only one can succeed (otherwise OPA will raise a conflict error). You need to resolve the conflict inside of your policy. There are different ways of handling this, e.g., default, else, negation, etc.