title: Rego Validation Array Compare
body: <p>I am new at Rego and I am trying to write a policy in order to check if there is a set of rules already created on certain Azure NSGs.</p>
  <p><strong>Input test:</strong></p>
  <pre><code>{
    &quot;name&quot;: &quot;&lt;name&gt;&quot;,
    &quot;id&quot;: &quot;&lt;id&gt;&quot;,
    &quot;etag&quot;: &quot;&lt;etag&gt;&quot;,
    &quot;type&quot;: &quot;&lt;resourcetype&gt;&quot;,
    &quot;location&quot;: &quot;&lt;location&gt;&quot;,
    &quot;properties&quot;:
    {
      &quot;provisioningState&quot;: &quot;Succeeded&quot;,
      &quot;resourceGuid&quot;: &quot;xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&quot;,
      &quot;securityRules&quot;:
      [
        {
          &quot;name&quot;: &quot;&lt;rule name&gt;&quot;,
          &quot;id&quot;: &quot;&lt;id&gt;&quot;,
          &quot;etag&quot;: &quot;&lt;etag&quot;,
          &quot;type&quot;: &quot;&lt;type&gt;&quot;,
          &quot;properties&quot;:
          {
            &quot;provisioningState&quot;: &quot;Succeeded&quot;,
            &quot;description&quot;: &quot;....&quot;,
            &quot;protocol&quot;: &quot;*&quot;,
            &quot;sourcePortRange&quot;: &quot;*&quot;,
            &quot;destinationPortRange&quot;: &quot;53&quot;,
            &quot;sourceAddressPrefix&quot;: &quot;*&quot;,
            &quot;access&quot;: &quot;Allow&quot;,
            &quot;priority&quot;: 1,
            &quot;direction&quot;: &quot;Outbound&quot;,
            &quot;sourcePortRanges&quot;: [],
            &quot;destinationPortRanges&quot;: [],
            &quot;sourceAddressPrefixes&quot;: [],
            &quot;destinationAddressPrefixes&quot;:
            [
              &quot;10.0.0.1&quot;,
              &quot;10.0.0.2&quot;,
              &quot;10.0.0.3&quot;
            ]
          }
        }
      ]
    {
  }
  </code></pre>
  <p>I wrote a custom function in order to check the values. Below is the code that I am testing in The Rego Playground</p>
  <pre><code>existRule(rule) = true
  {
      input.properties.securityRules[i].name == rule.name
      input.properties.securityRules[i].properties.provisioningState == rule.provisioningState
      input.properties.securityRules[i].properties.description == rule.description
      input.properties.securityRules[i].properties.protocol == rule.protocol
      input.properties.securityRules[i].properties.access == rule.access
      input.properties.securityRules[i].properties.priority == rule.priority
      input.properties.securityRules[i].properties.direction == rule.direction
  }
  rule = {
              &quot;name&quot;: &quot;name&quot;,
              &quot;provisioningState&quot;: &quot;Succeeded&quot;,
              &quot;description&quot;: &quot;description&quot;,
              &quot;protocol&quot;: &quot;*&quot;,
              &quot;sourcePortRange&quot;: &quot;*&quot;,
              &quot;destinationPortRange&quot;: &quot;1&quot;,
              &quot;sourceAddressPrefix&quot;: &quot;*&quot;,
              &quot;access&quot;: &quot;Allow&quot;,
              &quot;priority&quot;: 1,
              &quot;direction&quot;: &quot;Outbound&quot;,
              &quot;destinationAddressPrefix&quot;: &quot;&quot;,
              &quot;sourcePortRanges&quot;: [],
              &quot;destinationPortRanges&quot;: [],
              &quot;sourceAddressPrefixes&quot;: [],
              &quot;destinationAddressPrefixes&quot;: [
                  &quot;10.0.0.1&quot;,
                  &quot;10.0.0.2&quot;,
                  &quot;10.0.0.3&quot;,
                  &quot;10.0.0.4&quot;
              ]
          }
  
  rules
  {
      existRule(rule)
  }
  </code></pre>
  <p>which is working for the properties that I define above, however I am having an issue when trying to compare arrays, particularly in this example with <strong>destinationAddressPrefixes</strong>
  I have tried the following:</p>
  <pre><code>test1 { input.properties.securityRules[i].properties.destinationAddressPrefixes == rule.destinationAddressPrefixes }
  </code></pre>
  <p>Always returns false</p>
  <p>With the following line I can check one destination address from the input against a specific ip, however I can not achive a compare of all the address of the input against the ones of the rule that is defined in the example</p>
  <pre><code>onerule {input.properties.securityRules[i].properties.destinationAddressPrefixes[_] == &quot;10.0.0.1&quot;}
  test2 {input.properties.securityRules[i].properties.destinationAddressPrefixes[_] == rule.destinationAddressPrefixes[j]}
  test3 {input.properties.securityRules[i].properties.destinationAddressPrefixes[j] == rule.destinationAddressPrefixes[k]}
  </code></pre>
  <p>test2 and test3 always return true, even when there is a rule that is not in the input. I also tried and array difference</p>
  <pre><code>x := input.properties.securityRules[i].properties.destinationAddressPrefixes - rule.destinationAddressPrefixes
  </code></pre>
  <p>but I get the following error:</p>
  <blockquote>
  <p>rego_type_error: minus: invalid argument(s)   have: (any, array&lt;string,
  string, string, string, string, string, string, string, string,
  string, string, string, string, string&gt;, ???)     want: (any&lt;number,
  set[any]&gt;, any&lt;number, set[any]&gt;, any&lt;number, set[any]&gt;)</p>
  </blockquote>
  <p>Do you know if it is feasible to achieve what I am looking for? Or is there a different way to make a look of the array and compare the values one by one?</p>