README

dms-endpoint-should-be-ssl-configured.sentinel

Conversion Quality

Good

Why this converts reasonably well

The Sentinel version uses tfconfig/v2 to accept either a constant value or a reference for certificate_arn. tfpolicy cannot inspect Terraform config reference metadata the same way, but it can still validate that the planned certificate_arn value is non-empty.

Key translation notes

• Config-oriented Sentinel checks become an end-state tfpolicy check on attrs.certificate_arn
• tfpolicy focuses on the resulting planned value instead of whether it came from a literal or a reference

Limitations encountered

The tfpolicy version does not preserve the source-level distinction between constant values and references. It only checks that the final planned value is present.