CloudFront Associated With Waf Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: cloudfront-associated-with-waf.sentinel
2# Exact conversion quality: Not convertible
3# This tfpolicy only checks for a non-empty web_acl_id value.
4
5resource_policy "aws_cloudfront_distribution" "require_web_acl_id" {
6    locals {
7        web_acl_id = core::try(attrs.web_acl_id, "")
8    }
9
10    enforce {
11        condition = local.web_acl_id != ""
12        error_message = "CloudFront distributions should set web_acl_id to associate a WAF or WAF Classic ACL"
13    }
14}