Example Sentinel Policy for restring AWS region to environment

fail_aws_invalid_region.json

{
    "mock": {
      "tfplan": {
        "config": {
          "providers": [
            {
              "type": "aws",
              "config": {"region": "something else"}
            }
          ]
        }
      },
      "env": {"ENV": "staging"}
    },

    "test": {
        "main": false
    }
}

pass.json

{
    "mock": {
      "tfplan": {
        "config": {
          "providers": [
            {
              "type": "aws",
              "config": {"region": "us-west-1"}
            }
          ]
        }
      },
      "env": {"ENV": "staging"}
    },

    "test": {
        "main": true
    }
}

pass_not_aws.json

{
    "mock": {
      "tfplan": {
        "config": {
          "providers": [
            {
              "type": "gcp",
              "config": {"region": "something else"}
            }
          ]
        }
      },
      "env": {"ENV": "staging"}
    },

    "test": {
        "main": true
    }
}

staging.sentinel

import "env"
import "tfplan"

valid_regions = {"staging": "us-west-1", "production": "us-east-1"}

if_aws_ensure_valid_region = func(p) {
	if p.type is not "aws" {
		return true
	}

	return p.config.region is valid_regions[env.ENV]
}

main = rule {
	all tfplan.config.providers as p {
		if_aws_ensure_valid_region(p)
	}
}