Skip to main content

Writing a Custom Rule

Write, test, and activate a custom Rego rule.

This article explains how to write, test, and activate a custom compliance rule in Compliance Manager using the Rego policy language.

Overview

Compliance Manager lets you maintain your own custom guardrails by creating custom rules. Cye Cloud Posture Solution uses OPA and the Rego language to define and enforce compliance policies, so you write each rule as a Rego policy that runs against the data models of your connected cloud accounts.

  • Explore Data Models & Write the Policy: The Customized Rules page shows which objects your policy can reference (for example awsIamRoles or awsEc2Instances) and provides a Rego editor for the rule logic.

  • Test Before Activating: The Output panel evaluates the rule against any connected cloud account. Results are not stored.

  • Tag & Activate: Every rule needs at least one tag. Adding that tag to a running bundle activates the rule, and new rules with the same tag join the bundle automatically.

1. Open the Customized Rules page

  1. Log in to the console and go to the Compliance tab.

  2. Go to the Customized Rules page.

The page has three parts:

  1. Data model view

  2. Output panel

  3. Rego editor

2. Explore the data model view

Every Rego policy must use one or more data models, so start here to see what you can reference.

  • The panel lists the objects available to your Rego policy.

  • For example, awsIamRoles represents all the role objects in your environment, and awsEc2Instances represents all the EC2 instances in your environment.

3. Write the policy in the Rego editor

The Rego editor holds the compliance rule logic. The policy must follow these conventions:

  1. The package must be Solvo.

  2. The policy must reference at least one data model (for example data.awsAccounts).

  3. The policy must have a results field that holds the violations of the rule. The Output panel shows the results object.

  4. The results field must be one of the following:

    • An array of strings.

    • An array of objects with an Id field.

    • A single object with an Id field.

Example Rego policy:

package Solvo
import future.keywords

noncompliant_entities [item] {
	account = data.awsAccounts[_]
	item = {"Id": account.Id, "Name": account.Name}
}

results := noncompliant_entities

The output for the policy above:

4. Test the rule in the Output panel

The Output panel lets you check the rule before it affects any bundle.

  • Evaluate and test your rule against any of the connected cloud accounts.

  • Results are not stored and are only used for testing.

  • To activate the rule, save it with a tag associated with a running bundle (see the next section).

5. Tag and activate the rule

Tags connect a rule to a bundle and let you group related rules, for example all rules for the dev environment can share the tag dev-rules.

  1. Give the rule at least one tag and save it.

  2. Go to the Compliance Manager page.

  3. Click Actions > Edit Bundle. Your new tag appears in the Customized rule tags section.

  4. Select the tag and save the bundle.

Note: Once a custom tag is enabled in a bundle, any new rule that contains the tag is added to the bundle and becomes active automatically, without editing the bundle again.

Wrap-up / Next Steps

Related Articles
Did this answer your question?