title: Can I loop over keys and values of an object in OPA to validate if they adhere to a certain format (CamelCase)
body: <p>We are using <a href="https://github.com/instrumenta/conftest" rel="nofollow noreferrer">conftest</a> to validate if our terraform changeset applies to certain rules &amp; compliances. One thing we want to validate is wether our AWS resources are tagged according to the AWS tagging convention, which specifies certain tags to use (e.g. Owner, ApplicationRole, Project) and specifies that all tags and values are in CamelCase.</p>
  
  <p>in terraform the changeset is portrayed in the following (simplified) json output:</p>
  
  <pre><code>{
     "resource_changes":{
        "provider_name":"aws",
        "change":{
           "before":{
  
           },
           "after":{
              "tags":{
                 "ApplicationRole":"SomeValue",
                 "Owner":"SomeValue",
                 "Project":"SomeValue"
              }
           }
        }
     }
  }
  </code></pre>
  
  <p>What I am now trying to do is to validate the following:</p>
  
  <ol>
  <li>Check wether tags are set.</li>
  <li>Validate if the keys and values are all camelcase.</li>
  <li>Check that the keys include the set (ApplicationRole, Owner, Project) in the minimum.</li>
  </ol>
  
  <p>However, I am having trouble defining that in Rego (I am quite new to OPA).</p>
  
  <p>Is there a way to "loop" over the keys and values of an object, and validate if they are formatted correctly?</p>
  
  <p>in pseudo code:</p>
  
  <pre><code>for key, value in tags {
    re_match(`([A-Z][a-z0-9]+)+`, key)
    re_match(`([A-Z][a-z0-9]+)+`, value)
  }
  </code></pre>
  
  <p>I have tried the following:</p>
  
  <pre><code>tags_camel_case(tags) {
      some key
      val := tags[key]
      re_match(`^([A-Z][a-z0-9]+)+`, key) # why is key not evaluated?
      re_match(`^([A-Z][a-z0-9]+)+`, val)
  }
  </code></pre>
  
  <p>However, when evaluating against the following test json:</p>
  
  <pre><code>{
    "AppRole": "SomeValue",
    "appRole": "SomeValue"
  }
  </code></pre>
  
  <p>the rule returns true, even though I am checking both key and value vs the regex</p>