Motivation

The *_unrecommended_permission_policy_scenarios helpers in assets/libraries/common.rego were performing a full input.document[_] scan for every principal (role, user, group) they were called on. With Terraform module instantiation in place, input.document can contain many synthetic module documents, making each helper call O(principals × docs × policies). Because ~64 near-identical privilege-escalation rules call these helpers independently, the total cost was O(64 × principals × docs × policies) per scan, the primary contributor to multi-minute scan times on module-heavy repositories.

Benchmarks on a simulated module-inflated input (3,000 roles, 750 policies across 50 documents) measured 3,216 ms → 45 ms per rule (~71× speedup).

Changes

Rule library (assets/libraries/common.rego)

Three helper functions (role_unrecommended_permission_policy_scenarios, user_unrecommended_permission_policy_scenarios, group_unrecommended_permission_policy_scenarios) are replaced with an indexed design.

Two new helpers support the index:

_to_action_array normalises an Action field (string or array) to an array for uniform iteration.

_policy_wildcard_actions returns the set of lowercased Allow-on-"*" actions for a given policy resource object. OPA memoizes complete-rule calls per unique argument, so json_unmarshal is paid at most once per unique policy within a query.

Three complete set rules (_role_dangerous_pairs, _user_dangerous_pairs, _group_dangerous_pairs) pre-compute [principalName, permission] pairs across both scenarios (inline policies and policy attachments) for all principals at once. OPA evaluates and caches complete rules on first access; all subsequent lookups within the same query are O(1) set membership checks. This is the key difference from an incremental/partial-rule approach, which OPA specializes per bound key and does not cache across callers.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

1. opa test assets/libraries/ — all 324 existing tests must pass (no new tests are needed since the function signatures are unchanged and existing tests cover both scenarios).
2. go test ./pkg/engine/... -timeout 120s — engine tests must pass.
3. Optionally benchmark one slow rule before and after:

opa bench \
  -d assets/libraries/common.rego \
  -d assets/libraries/terraform.rego \
  -d <path-to-role_with_privilege_escalation_by_actions_iam_AttachRolePolicy/query.rego> \
  --input <module-heavy-input.json> \
  'data.datadog.DatadogPolicy'

Verify findings count is identical between the patched and unpatched library.

Blast Radius

DataDog IaC Scanner only. The change is limited to three helper functions in assets/libraries/common.rego.

Additional Notes

The ~64 role_with_privilege_escalation_by_actions_*, user_with_privilege_escalation_by_actions_*, and group_with_privilege_escalation_by_actions_* rules in the default rule corpus all benefit from this change without modification.

I submit this contribution under the Apache-2.0 license.