rego-policy-checker.py

package terraform.finops

deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_instance"
    allowed_types := {"t3.micro", "t3.small", "t3.medium"}
    not allowed_types[resource.change.after.instance_type]

    msg := sprintf(
        "Instance type %v is not in the approved list for this environment",
        [resource.change.after.instance_type]
    )
}