rds-must-be-encrypted.sentinel

# This policy uses the Sentinel tfplan/v2 import to require that
# All RDS resources have its storage encrypted

# Import common-functions/tfplan-functions/tfplan-functions.sentinel
# with alias "plan"
import "tfplan-functions" as plan

# Get all RDS resources
allRDS = plan.find_resources("aws_db_instance")

# Filter to elastic domains that are not encrypted
# Warnings will be printed for all violations since the last parameter is true

nonEncryptedRDS = plan.filter_attribute_is_not_value(allRDS,
	"storage_encrypted",
	true, false)

# Main rule
validated = length(nonEncryptedRDS["messages"]) is 0
main = rule {
	validated is true
}