Cloudtrail Server Side Encryption Enabled Policy

1# Converted from HashiCorp PCI DSS Sentinel example: cloudtrail-server-side-encryption-enabled.sentinel
2# Conversion quality: Good
3
4resource_policy "aws_cloudtrail" "cloudtrail_server_side_encryption_enabled" {
5    locals {
6        kms_key_id = core::try(attrs.kms_key_id, "")
7    }
8
9    enforce {
10        condition = local.kms_key_id != ""
11        error_message = "CloudTrail resources must set kms_key_id for server-side encryption"
12    }
13}