Clean up the engine code to be a bit clearer.

- Refactor the terraform example

Signed-off-by: Hamish Hutchings <hamish@drybrough.nl>

Author: moredhel

examples/excludes/policy/deny.rego

@@ -2,14 +2,14 @@ package main
 
 exceptions = {"exception-name"}
 
-func_name_msg(name) = ret {
-	ret := sprintf("Resource Name '%s' contains dashes", [name])
-}
-
-deny_name[msg] {
+deny_name[result] {
 	input.resource[_][name]
 	contains(name, "-")
-	msg := func_name_msg(name)
+	msg := sprintf("Resource Name '%s' contains dashes", [name])
+	result := {
+		"msg": msg,
+		"resource-name": name,
+	}
 }
 
 deny_resource_type[msg] {
@@ -18,10 +18,9 @@ deny_resource_type[msg] {
 	msg := sprintf("Resource Type '%s' is invalid", [type])
 }
 
-exclude_name[rules] {
-	input.resource[_][name]
+exclude_name[attrs] {
 	exceptions[name]
-	rules := [func_name_msg(name)]
+	attrs := [{"resource-name": name}]
 }
 
 exception[rules] {

policy/engine.go

@@ -316,21 +316,29 @@ func (e *Engine) check(ctx context.Context, path string, config interface{}, nam
 			}
 
 			result, err := json.Marshal(ruleResult.Metadata)
-			localExcludeQuery := fmt.Sprintf("data.%s.exclude_%s[_][_] = %s", namespace, removeRulePrefix(rule), result)
-			localExcludeQueryResult, err := e.query(ctx, config, localExcludeQuery)
 			if err != nil {
-				return output.CheckResult{}, fmt.Errorf("query exception: %w", err)
+				return output.CheckResult{}, fmt.Errorf("json marshal: %w", err)
 			}
 
-			// If the query was a failure, let's have a look & see if an exception was written for it.
-			if len(localExcludeQueryResult.Results) > 0 {
-				// append an exception & continue
-				localExcludeResult := localExcludeQueryResult.Results[0]
-				localExcludeResult.Message = localExcludeQuery
-				excludes = append(excludes, localExcludeResult)
-				continue
-			}
+			// If we have a non-null metadata response, then we are eligible to exclude the policy.
+			// Otherwise we can just skip & process the policy violation
+			if string(result) != "null" {
+				localExcludeQuery := fmt.Sprintf("data.%s.exclude_%s[_][_] = %s", namespace, removeRulePrefix(rule), result)
+				localExcludeQueryResult, err := e.query(ctx, config, localExcludeQuery)
+				if err != nil {
+					return output.CheckResult{}, fmt.Errorf("query exception: %w", err)
+				}
 
+				// If the query was a failure, let's have a look & see if an exception was written for it.
+				if len(localExcludeQueryResult.Results) > 0 {
+					// append an exception & continue
+					localExcludeResult := localExcludeQueryResult.Results[0]
+					localExcludeResult.Message = localExcludeQuery
+					excludes = append(excludes, localExcludeResult)
+					continue
+				}
+
+			}
 			if isFailure(rule) {
 				failures = append(failures, ruleResult)
 			} else {