GoogleCloudPlatform / GoogleCloudPlatform/config-validator

glob(i.e. **) does not work in target match for policies

Open
#142 10 comments 0 reactions 1 assignee Claimed by @briantkennedy View on GitHub
Dominant language
Go
Stars
48
Forks
37
PR merge metrics
No merged PRs in 30d

Description

When I use ** in the `target` field under `match`, Forseti Config Validator errors out.

Policy:
```
apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPStorageLocationConstraintV1
metadata:
name: allow_some_storage_location
annotations:
description: Checks Cloud Storage bucket locations against allowed or disallowed
locations.
spec:
severity: high
match:
target: ["**/project/*"]
parameters:
mode: "allowlist"
locations:
- asia-southeast1
exemptions: []
```

Error message snippet:
```
failed to evaluate review: core.dependencies.audit:25: eval_builtin_error: re_match: error parsing regexp: missing argument to repetition operator: `*`
```

From the CV regex matching [tests](https://github.com/forseti-security/config-validator/blob/1851e960cf3c357a62948c3de088fd3234f1c372/pkg/gcptarget/gcptarget_test.go), it seems such feature is supported.

It's a very useful feature to help make sure policy target can always match the ancestry path no matter what `composite_root_resources` in the forseti server config is.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.