add protect-against-rds-instance-deletion.sentinel

Author: rberlind

governance/third-generation/aws/protect-against-rds-instance-deletion.sentinel

@@ -0,0 +1,27 @@
+# This policy uses the Sentinel tfplan/v2 import to prevent deletion
+# of RDS instances that have `deletion_protection` set to true.
+# Note that it is unusual in using `change.actions.before` instead of
+# `change.actions.after`.
+
+# Import common-functions/tfplan-functions/tfplan-functions.sentinel
+# with alias "plan"
+import "tfplan-functions" as plan
+
+# Get all RDS instances
+RDSInstancesBeingDeleted = plan.find_resources_being_destroyed("aws_db_instance")
+
+
+# Filter to RDS instances with violations
+# Warnings will be printed for all violations since the last parameter is true
+violatingRDSInstances = plan.filter_attribute_was_value(RDSInstancesBeingDeleted,
+                        "deletion_protection", true, false)
+
+length(violatingRDSInstances["messages"]) > 0 {
+  print("RDS instances with deletion_protection set to true cannot be destroyed.")
+  plan.print_violations(violatingRDSInstances["messages"], "")
+}
+
+# Main rule
+main = rule {
+  length(violatingRDSInstances["messages"]) is 0
+}

governance/third-generation/common-functions/tfplan-functions/tfplan-functions.sentinel

@@ -507,6 +507,44 @@ filter_attribute_is_not_value = func(resources, attr, value, prtmsg) {
   return {"resources":violators,"messages":messages}
 }
 
+### filter_attribute_was_not_value ###
+# Filter a list of resources to those with a specified
+# attribute (attr) that did not have a given value.
+# Resources should be derived by applying filters to tfplan.resource_changes.
+# Set prtmsg to `true` (without quotes) if you want to print violation messages.
+# If you want to match null, set value to "null".
+# Note that it this function passes `change.actions.before` instead of `rc`
+# to the evaluate_attribute() function which converts `rc` to `rc.change.after`.
+filter_attribute_was_not_value = func(resources, attr, value, prtmsg) {
+  violators = {}
+	messages = {}
+  for resources as address, rc {
+    v = evaluate_attribute(rc.change.before, attr) else null
+    if v is null {
+      # Add the resource and a warning message to the violators list
+      message = to_string(address) + " had " + to_string(attr) +
+                " that was null or undefined. " + "It was supposed to be " +
+                to_string(value)
+      violators[address] = rc
+			messages[address] = message
+      if prtmsg {
+        print(message)
+      }
+    } else if v is not value {
+      # Add the resource and a warning message to the violators list
+      message = to_string(address) + " had " + to_string(attr) + " with value " +
+                to_string(v) + " that was not equal to " + to_string(value)
+      violators[address] = rc
+			messages[address] = message
+      if prtmsg {
+        print(message)
+      }
+    }
+  }
+  return {"resources":violators,"messages":messages}
+}
+
+
 ### filter_attribute_is_value ###
 # Filter a list of resources to those with a specified
 # attribute (attr) that has a given value.
@@ -535,6 +573,36 @@ filter_attribute_is_value = func(resources, attr, value, prtmsg) {
   return {"resources":violators,"messages":messages}
 }
 
+### filter_attribute_was_value ###
+# Filter a list of resources to those with a specified
+# attribute (attr) that had a given value.
+# Resources should be derived by applying filters to tfplan.resource_changes.
+# Set prtmsg to `true` (without quotes) if you want to print violation messages.
+# If you want to match null, set value to "null".
+# Note that it this function passes `change.actions.before` instead of `rc`
+# to the evaluate_attribute() function which converts `rc` to `rc.change.after`.
+filter_attribute_was_value = func(resources, attr, value, prtmsg) {
+  violators = {}
+	messages = {}
+  for resources as address, rc {
+    v = evaluate_attribute(rc.change.before, attr) else null
+    if v is null {
+      v = "null"
+    }
+    if v is value {
+      # Add the resource and a warning message to the violators list
+      message = to_string(address) + " had " + to_string(attr) + " with value " +
+                to_string(v) + " that was not allowed."
+      violators[address] = rc
+			messages[address] = message
+      if prtmsg {
+        print(message)
+      }
+    }
+  }
+  return {"resources":violators,"messages":messages}
+}
+
 ### filter_attribute_greater_than_value ###
 # Filter a list of resources to those with a specified
 # attribute (attr) that is greater than a given numeric value.