RDS

1# Intentionally non-compliant fixture — DO NOT deploy, DO NOT sanitize.
2# Exercises: rds_not_public must still fire when a brace appears inside a quoted
3# string NESTED IN AN INTERPOLATION.
4#
5# The lexer's first revision ended the outer string at the inner string's closing
6# quote, so the rest of the line was scanned as code. The `{` in "primary{db" then
7# counted toward brace depth, putting `publicly_accessible = true` at depth 2 —
8# judged a nested attribute and skipped. Worse, it reported a FALSE
9# rds_encryption_at_rest at the same time, with storage_encrypted = true present.
10# So this shape must produce exactly one violation: rds_not_public.
11resource "aws_db_instance" "interpolated_brace" {
12  identifier          = "${lookup(var.names, "primary{db")}"
13  instance_class      = "db.t3.micro"
14  engine              = "postgres"
15  publicly_accessible = true
16  storage_encrypted   = true
17}