rds_update.rego

package main

import input as tfplan

resource_types = {"aws_db_instance"}

minimum_tags = min_updated_tags {
    some resource_type
    min_updated_tags := updated_tags[resource_type]
}

contains(arr, i) {
  arr[_] = i
}

tags_contain_proper_keys(tags) = true {
  contains(tags, "environment")
  contains(tags, "managed_by")
  contains(tags, "team")
} else = false { true }

updated_tags[resource_type] = num {
    some resource_type
    resource_types[resource_type]
    all := resources[resource_type]

    update_resources := [res | res:= all[_]; res.change.actions[_] == "update"]
    tag_changeset := [res | res := [key | update_resources[_].change.after.tags[key]]]
    num := tags_contain_proper_keys(tag_changeset[_])
}

resources[resource_type] = all {
    some resource_type
    resource_types[resource_type]
    all := [name |
        name:= tfplan.resource_changes[_]
        name.type == resource_type
    ]
}

deny["(policy/rds_update.rego) Minimum RDS Tags not set. Must include: [\"managed_by\", \"environment\", \"team\"]"] {
  minimum_tags == false
}