Defining an OPA policy

With the local OPA mode, the users use the local files located in the /etc/stormshield/cse directory.

If using Stormshield KMaaS on several instances, you must apply the following procedure on all instances.

1. Edit the two files needed to define a policy for the module you are implementing: the KACLS, Crypto API, or Key Access Management:

   Module	File name	Description
   KACLS	policy.wasm	This file defines the policy rules, based on request inputs It is generated from a rego file, Use the OPA command line tool to generate it, Use The rego Playground to develop and test a policy.
   Crypto API	policy-crypto-api.wasm
   KAS	policy-kas.wasm
   DKE	policy-dke.wasm
   Admin	policy-admin.wasm
   KACLS	policy.data.json	This file contains data that can be referenced in the rego file. It makes it possible to add variables to the policy.wasm file so that you do not to have to recompile the file each time you modify it.
   Crypto API	policy-crypto-api.data.json
   KAS	policy-kas.data.json
   DKE	policy-dke.data.json
   Admin	policy-admin.data.json

   In RPM mode, both these files already exist in /etc/stormshield/cse only for the KACLS. They define a default policy which allows all requests. If you want to create your own policy, customize these files using the inputs and the examples provided in the following sections.

   In Docker mode, these default policy files are provided along with the Docker image. You can place them in the folder containing your configuration files, or define your own.

    

   The .wasm and .json files are mandatory if the policy_enforcement.enable parameter value is set to true and if the type is opa_local in the config.json file. For more information, see Configuring the KACLS Configuring Crypto API, or Configuring the Key Access Management.

   If one of the files is not present and the parameter value is set to true, the service will not start and the corresponding module (i.e., KACLS, Crypto API or KAS) will be disabled. A log is also issued to indicate that the policy is disabled.

2. Run the restart command to take into account the modified .wasm and .json files. If one of the files is not valid, the service does not start and a log is issued. For more information, refer to the section Logs relating to the application of an OPA policy of the Log Guide.

With the OPA server mode, the users contact an OPA server to get the result of an online policy. This mode allows you to centralize the policy and avoids duplicating the file on several instances in the case of a multi-instance architecture.

With this mode, you must implement the verification of Basic authentication, either via the tools provided by OPA or via another method such as a gateway.

To use this mode in your configuration, in the config.json file, section policy_enforcement, set the type parameter to opa_server for the KACLS, Crypto API, or the Key Access Management.

For more information, refer to sections Configuring the KACLS, Configuring Crypto API or Configuring the Key Access Management.

To configure the policies on your OPA server, refer to the OPA Rest API documentation . Stormshield guarantees compatibility with OPA version 1.2.0.