restrict-current-ec2-instance-type.sentinel

# This policy uses the Sentinel tfstate/v2 import to require that
# all existing EC2 instances have instance types from an allowed list

# Import common-functions/tfstate-functions/tfstate-functions.sentinel
# with alias "state"
import "tfstate-functions" as state

# Allowed EC2 Instance Types
# Include "null" to allow missing or computed values
allowed_types = ["t2.small", "t2.medium", "t2.large"]

# Get all EC2 instances
allEC2Instances = state.find_resources("aws_instance")

# Filter to EC2 instances with violations
# Warnings will be printed for all violations since the last parameter is true
violatingEC2Instances = state.filter_attribute_not_in_list(allEC2Instances,
                        "instance_type", allowed_types, true)

# Main rule
main = rule {
  length(violatingEC2Instances["messages"]) is 0
}