```

### 2. Create a sample OPA Policy

In another terminal, create a policy that allows root user all access and for all other users denies `PutObject`:

```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

Shinsuke Sugaya <******@****.***> 1566712401 +0900

Joe Tsai <******@****.***> 1443691829 -0700

	<property name="modules.dir" value="${basedir}/modules" />
	<property name="target.dir" value="${basedir}/target/modules" />

	<!-- Maven Repository -->
	<property name="maven.snapshot.repo.url" value="https://maven.codelibs.org/" />
	<property name="maven.release.repo.url" value="https://maven.codelibs.org/" />
	<property name="opensearch.version" value="2.17.1" />

	<target name="install.modules">
		<mkdir dir="${target.dir}" />

        } else {
            // process the list
            String[] repos = pattern.split(",");
            for (String repo : repos) {
                repo = repo.trim();
                // see if this is a negative match
                if (repo.length() > 1 && repo.startsWith("!")) {
                    if (repo.substring(1).equals(originalId)) {
                        // explicitly exclude. Set result and stop processing.

			<param name="repo.url" value="${maven.release.repo.url}" />
			<param name="plugin.groupId" value="org/codelibs/opensearch" />
			<param name="plugin.name.prefix" value="opensearch-" />
			<param name="plugin.name" value="configsync" />
			<param name="plugin.version" value="2.17.1" />
			<param name="plugin.zip.version" value="2.17.1" />
		</antcall>
		<!-- minhash -->
		<antcall target="install.plugin">

        if (selector != null) {
            RemoteRepository repo = RepositoryUtils.toRepo(repository);
            org.eclipse.aether.repository.Authentication auth = selector.getAuthentication(repo);
            if (auth != null) {
                repo = new RemoteRepository.Builder(repo)
                        .setAuthentication(auth)
                        .build();

  <repositories>
    <repository>
      <id>repo</id>
      <url>file://${basedir}/target/remote-repo</url>
    </repository>
    <repository>
      <id>repo-project-basedir</id>
      <url>file://${project.basedir}/sdk/maven/repo</url>
    </repository>
    <repository>
      <id>repo-project-baseUri</id>
      <url>${project.baseUri}/sdk/maven/repo</url>
    </repository>
  </repositories>

        Profile profile = new Profile();
        Repository repo = new Repository();
        repo.setId("local");
        profile.addRepository(repo);
        repo = new Repository();
        repo.setId("illegal\\:/chars");
        repo.setUrl("http://void");
        profile.addRepository(repo);
        Settings settings = new Settings();
        settings.addProfile(profile);

# WARNING: DO NOT EDIT, THIS FILE IS PROBABLY A COPY
#
# The original version of this file is located in the https://github.com/istio/common-files repo.
# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

ignored:
  - DL3008
  - DL3059

trustedRegistries:
  - gcr.io
  - docker.io