flex-auth/examples/ops-warden/policy_package.md

id	name	namespace	version	status	package	actions	owner	fixtures	caring	activation	metadata
ops-warden.ssh-certificate.sign	Ops-Warden SSH certificate signing	ops-warden:ssh-certificate	v2	ready	flexauth.ops_warden.ssh_signing	sign	team:platform-security	policy_fixtures.yaml	profile enforce canonical_roles organization_relations scopes planes capabilities exposure_modes conditions restrictions caring-0.4.0-rc2 false Operator ServiceProvider level id tenant Platform platform:ssh-signing tenant:platform Identity Secret Audit Use Operate Audit Metadata TimeLimited Logged PrivilegeEscalationBlocked SecretAccessBlocked	mode local	source ops_warden_policy_gate security_zone_standard examples/ops-warden/policy_package.md security-zones-v0.1 security-zones_v0.1

Ops-Warden SSH Certificate Signing

This package authorizes ops-warden's zone-aware pre-sign policy gate. The caller keeps SSH CA custody, actor inventory, and OpenBao signing; flex-auth decides whether a specific sign request is allowed now.

Rules

import future.keywords.contains
import future.keywords.if
import future.keywords.in

actor_types := {"adm", "agt", "atm"}

decision := {"effect": "allow", "reason": "signing_policy_matched"} if {
  security_zone_stance == "enforced"
  allowed
} else := {"effect": "deny", "reason": first_denial} if {
  security_zone_stance == "enforced"
} else := {"effect": "audit_only", "reason": advisory_reason} if {
  true
}

default security_zone := "unknown"

security_zone := input.resource.attributes.security_zone if {
  input.resource.attributes.security_zone in {
    "z0-experimental",
    "z1-operational",
    "z2-protected",
    "z2-continuity",
    "z3-critical",
    "unknown",
  }
}

default security_zone_stance := "advisory"

security_zone_stance := "enforced" if {
  security_zone in {"z2-protected", "z2-continuity", "z3-critical"}
}

security_zone_stance := "enforced" if {
  input.resource.attributes.security_zone_admission == "not-applicable"
}

base_reason := "signing_policy_matched" if {
  allowed
} else := first_denial if {
  true
}

advisory_reason := sprintf("advisory_would_%s", [base_reason])

allowed if {
  input.action == "sign"
  input.resource.system == "ops-warden"
  input.resource.type == "ssh-certificate"
  effective_tenant == "tenant:platform"
  valid_actor_type
  subject_type_matches_context
  actor_type_matches_resource
  resource_id_matches_actor
  subject_id_allowed
  valid_ttl
  has_pubkey_fingerprint
  principals_allowed
}

default effective_tenant := ""

effective_tenant := input.tenant if {
  is_string(input.tenant)
  input.tenant != ""
} else := input.resource.tenant if {
  is_string(input.resource.tenant)
  input.resource.tenant != ""
} else := input.subject.tenant if {
  is_string(input.subject.tenant)
  input.subject.tenant != ""
}

default first_denial := "no_matching_rule"

first_denial := "wrong_action" if {
  input.action != "sign"
} else := "wrong_system" if {
  input.resource.system != "ops-warden"
} else := "wrong_resource_type" if {
  input.resource.type != "ssh-certificate"
} else := "wrong_tenant" if {
  effective_tenant != "tenant:platform"
} else := "unknown_actor_resource" if {
  not has_actor_resource
} else := "unknown_subject" if {
  not subject_id_allowed
} else := "actor_type_mismatch" if {
  not valid_actor_type
} else := "actor_type_mismatch" if {
  not subject_type_matches_context
} else := "actor_type_mismatch" if {
  not actor_type_matches_resource
} else := "actor_resource_mismatch" if {
  not resource_id_matches_actor
} else := "ttl_out_of_bounds" if {
  not valid_ttl
} else := "missing_pubkey_fingerprint" if {
  not has_pubkey_fingerprint
} else := "missing_principal" if {
  not has_principals
} else := "disallowed_principal" if {
  count(disallowed_principals) > 0
}

has_actor_resource if {
  is_string(input.resource.attributes.actor_id)
  input.resource.attributes.actor_id != ""
}

valid_actor_type if {
  is_string(input.context.actor_type)
  input.context.actor_type in actor_types
}

subject_type_matches_context if {
  input.subject.type == input.context.actor_type
}

subject_type_matches_context if {
  input.subject.attributes.actor_type == input.context.actor_type
}

actor_type_matches_resource if {
  input.context.actor_type == input.resource.attributes.actor_type
}

resource_id_matches_actor if {
  input.resource.id == sprintf("ssh-cert:actor/%s", [input.resource.attributes.actor_id])
}

subject_id_allowed if {
  input.subject.id in input.resource.attributes.allowed_subjects
}

has_ttl if {
  is_number(input.context.ttl_hours)
}

valid_ttl if {
  has_ttl
  input.context.ttl_hours > 0
  input.context.ttl_hours <= input.resource.attributes.max_ttl_hours
}

has_pubkey_fingerprint if {
  is_string(input.context.pubkey_fingerprint)
  input.context.pubkey_fingerprint != ""
}

has_principals if {
  count(input.context.principals) > 0
}

principals_allowed if {
  has_principals
  count(disallowed_principals) == 0
}

allowed_principal(principal) if {
  principal in input.resource.attributes.allowed_principals
}

disallowed_principals contains principal if {
  principal := input.context.principals[_]
  not allowed_principal(principal)
}

Tests

package flexauth.ops_warden.ssh_signing_test

import future.keywords.if
import data.flexauth.ops_warden.ssh_signing

adm_request := {
  "id": "check:ops-warden-platform-steward-adm",
  "tenant": "tenant:platform",
  "subject": {"id": "platform-steward", "type": "adm"},
  "action": "sign",
  "resource": {
    "id": "ssh-cert:actor/platform-steward",
    "type": "ssh-certificate",
    "system": "ops-warden",
    "attributes": {
      "actor_id": "platform-steward",
      "actor_type": "adm",
      "allowed_subjects": ["platform-steward", "iam:platform-steward"],
      "allowed_principals": ["platform", "root"],
      "max_ttl_hours": 8,
      "security_zone": "z2-protected",
      "security_zone_admission": "satisfied"
    }
  },
  "context": {
    "actor_type": "adm",
    "principals": ["platform"],
    "pubkey_fingerprint": "SHA256:example-adm-fingerprint",
    "ttl_hours": 4
  }
}

test_adm_sign_allowed if {
  ssh_signing.decision.effect == "allow" with input as adm_request
}

test_high_ttl_denied if {
  ssh_signing.decision.reason == "ttl_out_of_bounds" with input as {
    "tenant": "tenant:platform",
    "subject": {"id": "platform-steward", "type": "adm"},
    "action": "sign",
    "resource": adm_request.resource,
    "context": {
      "actor_type": "adm",
      "principals": ["platform"],
      "pubkey_fingerprint": "SHA256:example-adm-fingerprint",
      "ttl_hours": 12
    }
  }
}

test_missing_fingerprint_denied if {
  ssh_signing.decision.reason == "missing_pubkey_fingerprint" with input as {
    "tenant": "tenant:platform",
    "subject": {"id": "platform-steward", "type": "adm"},
    "action": "sign",
    "resource": adm_request.resource,
    "context": {
      "actor_type": "adm",
      "principals": ["platform"],
      "ttl_hours": 4
    }
  }
}

test_unknown_zone_is_advisory if {
  ssh_signing.decision.effect == "audit_only" with input as object.union(
    adm_request,
    {"resource": object.union(adm_request.resource, {"attributes": object.union(
      adm_request.resource.attributes,
      {"security_zone": "unknown", "security_zone_admission": "unknown"},
    )})},
  )
}

test_native_non_workload_subject_keeps_enforced_policy if {
  ssh_signing.decision.effect == "allow" with input as object.union(
    adm_request,
    {"resource": object.union(adm_request.resource, {"attributes": object.union(
      adm_request.resource.attributes,
      {"security_zone": "unknown", "security_zone_admission": "not-applicable"},
    )})},
  )
}