How to import a json file to use within a rego policy

[omansh-arora]

For instance, I have an "example.json" file in the same directory as my rego policy. Can I import this json file to use in my policy? The reason I need to do this is because I need to compare the input json file (Which I'm passing in the opa exec command) againt this json file.

[ashutosh-narkar]

You can store policy and data in a Bundle and pass that to opa exec via the --bundle flag or have it pull down the bundle from the remote server. You should also be able to specify the file on the command line and be able to use that in the policy. I would recommend the former. I haven't tried the latter approach.

[johanfylling]

To expand on @ashutosh-narkar's answer, once you have passed the json document to the runtime - be it through a bundle or as a command line argument - you can access that document through the data root document. E.g.

policy.rego:

package ex
import rego.v1

allow if {
  data.foo.bar == "baz"
}

example.json:

{
  "foo": {
    "bar": "baz"
  }
}

$ opa eval -d policy.rego -d example.json 'data.ex.allow'

You can of course import the data, just as you would regular Rego packages/rules:

package ex
import rego.v1
import data.foo

allow if {
  foo.bar == "baz"
}

[omansh-arora]

Thank you both for replying. The bundle approach isn't working for me I'm not sure why. It seems the policy cannot access the example.json file. I have verified that the input file is correct as when I test with just the input file the policy works. My folder structure currently looks like this:

\bundle
-> test.rego
-> input.json
-> example.json

My code looks like this:
test.rego:

package test
import input.plan as tfplan
import data.exceptions as exceptions

deny[msg] {
    # Get all resource changes from TF plan
    r := tfplan.resource_changes[_]
    e := exceptions[_]
    # Check that the resource name is the exception name
    e.name == r.name
    msg := "Denied"
}

example.json:

{
    "exceptions": [
        {
            "name": "testkey"
        }
    ]
}

The command I'm using:
opa exec --decision test/deny --bundle ./ kmsfalse.json

[ashutosh-narkar]

See the Bundle File Format. Your data file should be named data.json.