output

$ cat tfplan.json | conftest test -

2 tests, 2 passed, 0 warnings, 0 failure

rds.tf

provider "aws" {
  region  = "us-east-1"
  version = "~> 2.30"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  storage_type         = "gp2"
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t2.micro"
  name                 = "mydb"
  username             = "foo"
  password             = "foobarbaz"
  parameter_group_name = "default.mysql5.7"
  tags = {
    managed_by = "terraform"
    service = ""
    environment = "whatever"
  }
}

rds_create.rego

package main

import data.tag
import input as tfplan

resource_types = {"aws_db_instance"}

minimum_created_tags = min_created_tags {
    some resource_type
    min_created_tags := created_tags[resource_type]
}

created_tags[resource_type] = num {
    some resource_type
    resource_types[resource_type]
    all := resources[resource_type]

    create_resources := [res | res:= all[_]; res.change.actions[_] == "create"]
    
    tag_changeset := { changeset |
    	resource := create_resources[_]
    	changeset := {key | resource.change.after.tags[key]}
    }
    num := tag.tags_contain_proper_keys(tag_changeset[_])
}

resources[resource_type] = all {
    some resource_type
    resource_types[resource_type]
    all := [name |
        name:= tfplan.resource_changes[_]
        name.type == resource_type
    ]
}

deny["(policy/rds_create.rego) Minimum RDS Tags not set. Must include: managed_by, environment, team"] {
  minimum_created_tags == false
}

rds_update.rego

package main

import data.tag
import input as tfplan

resource_types = {"aws_db_instance"}

minimum_updated_tags = min_updated_tags {
    some resource_type
    min_updated_tags := updated_tags[resource_type]
}

updated_tags[resource_type] = num {
    some resource_type
    resource_types[resource_type]
    all := resources[resource_type]

    update_resources := [res | res:= all[_]; res.change.actions[_] == "update"]
    
    tag_changeset := { changeset |
    	resource := update_resources[_]
    	changeset := {key | resource.change.after.tags[key]}
    }
    num := tag.tags_contain_proper_keys(tag_changeset[_])
}

resources[resource_type] = all {
    some resource_type
    resource_types[resource_type]
    all := [name |
        name:= tfplan.resource_changes[_]
        name.type == resource_type
    ]
}

deny["(policy/rds_update.rego) Minimum RDS Tags not set. Must include: managed_by, environment, service"] {
  minimum_updated_tags == false
}

tag.rego

package tag

contains(arr, i) {
  arr[_] = i
}

tags_contain_proper_keys(tags) = true {
  contains(tags, "environment")
  contains(tags, "managed_by")
  contains(tags, "service")
} else = false { true }

tfplan.json

{
  "format_version": "0.1",
  "terraform_version": "0.12.20",
  "planned_values": {
    "root_module": {
      "resources": [
        {
          "address": "aws_db_instance.default",
          "mode": "managed",
          "type": "aws_db_instance",
          "name": "default",
          "provider_name": "aws",
          "schema_version": 1,
          "values": {
            "allocated_storage": 20,
            "allow_major_version_upgrade": null,
            "auto_minor_version_upgrade": true,
            "copy_tags_to_snapshot": false,
            "delete_automated_backups": true,
            "deletion_protection": null,
            "domain": null,
            "domain_iam_role_name": null,
            "enabled_cloudwatch_logs_exports": null,
            "engine": "mysql",
            "engine_version": "5.7",
            "final_snapshot_identifier": null,
            "iam_database_authentication_enabled": null,
            "instance_class": "db.t2.micro",
            "iops": null,
            "max_allocated_storage": null,
            "monitoring_interval": 0,
            "name": "mydb",
            "parameter_group_name": "default.mysql5.7",
            "password": "foobarbaz",
            "performance_insights_enabled": false,
            "publicly_accessible": false,
            "replicate_source_db": null,
            "s3_import": [],
            "security_group_names": null,
            "skip_final_snapshot": false,
            "snapshot_identifier": null,
            "storage_encrypted": null,
            "storage_type": "gp2",
            "tags": {
              "environment": "whatever",
              "managed_by": "terraform",
              "service": ""
            },
            "timeouts": null,
            "username": "foo"
          }
        }
      ]
    }
  },
  "resource_changes": [
    {
      "address": "aws_db_instance.default",
      "mode": "managed",
      "type": "aws_db_instance",
      "name": "default",
      "provider_name": "aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "allocated_storage": 20,
          "allow_major_version_upgrade": null,
          "auto_minor_version_upgrade": true,
          "copy_tags_to_snapshot": false,
          "delete_automated_backups": true,
          "deletion_protection": null,
          "domain": null,
          "domain_iam_role_name": null,
          "enabled_cloudwatch_logs_exports": null,
          "engine": "mysql",
          "engine_version": "5.7",
          "final_snapshot_identifier": null,
          "iam_database_authentication_enabled": null,
          "instance_class": "db.t2.micro",
          "iops": null,
          "max_allocated_storage": null,
          "monitoring_interval": 0,
          "name": "mydb",
          "parameter_group_name": "default.mysql5.7",
          "password": "foobarbaz",
          "performance_insights_enabled": false,
          "publicly_accessible": false,
          "replicate_source_db": null,
          "s3_import": [],
          "security_group_names": null,
          "skip_final_snapshot": false,
          "snapshot_identifier": null,
          "storage_encrypted": null,
          "storage_type": "gp2",
          "tags": {
            "environment": "whatever",
            "managed_by": "terraform",
            "team": "test"
          },
          "timeouts": null,
          "username": "foo"
        },
        "after_unknown": {
          "address": true,
          "apply_immediately": true,
          "arn": true,
          "availability_zone": true,
          "backup_retention_period": true,
          "backup_window": true,
          "ca_cert_identifier": true,
          "character_set_name": true,
          "db_subnet_group_name": true,
          "endpoint": true,
          "hosted_zone_id": true,
          "id": true,
          "identifier": true,
          "identifier_prefix": true,
          "kms_key_id": true,
          "license_model": true,
          "maintenance_window": true,
          "monitoring_role_arn": true,
          "multi_az": true,
          "option_group_name": true,
          "performance_insights_kms_key_id": true,
          "performance_insights_retention_period": true,
          "port": true,
          "replicas": true,
          "resource_id": true,
          "s3_import": [],
          "status": true,
          "tags": {},
          "timezone": true,
          "vpc_security_group_ids": true
        }
      }
    }
  ],
  "configuration": {
    "provider_config": {
      "aws": {
        "name": "aws",
        "version_constraint": "~> 2.30",
        "expressions": {
          "region": {
            "constant_value": "us-east-1"
          }
        }
      }
    },
    "root_module": {
      "resources": [
        {
          "address": "aws_db_instance.default",
          "mode": "managed",
          "type": "aws_db_instance",
          "name": "default",
          "provider_config_key": "aws",
          "expressions": {
            "allocated_storage": {
              "constant_value": 20
            },
            "engine": {
              "constant_value": "mysql"
            },
            "engine_version": {
              "constant_value": "5.7"
            },
            "instance_class": {
              "constant_value": "db.t2.micro"
            },
            "name": {
              "constant_value": "mydb"
            },
            "parameter_group_name": {
              "constant_value": "default.mysql5.7"
            },
            "password": {
              "constant_value": "foobarbaz"
            },
            "storage_type": {
              "constant_value": "gp2"
            },
            "tags": {
              "constant_value": {
                "environment": "whatever",
                "managed_by": "terraform",
                "team": "test"
              }
            },
            "username": {
              "constant_value": "foo"
            }
          },
          "schema_version": 1
        }
      ]
    }
  }
}