Prohibit defining any s3 buckets

aws-restrict-s3-buckets.sentinel

import "tfplan"

# Get all S3 buckets from all modules
get_s3_buckets = func() {
    buckets = []
    for tfplan.module_paths as path {
        buckets += values(tfplan.module(path).resources.aws_s3_bucket) else []
    }
    return buckets
}

s3_buckets = get_s3_buckets()

# Rule to restrict usage of S3 buckets
no_s3 = rule {
  length(s3_buckets) < 1
}

# Main rule that requires other rules to be true
main = rule {
  no_s3 else true
}