README

dms-endpoints-should-use-ssl.sentinel

Conversion Quality

Perfect

Why it converts well

This policy is a straightforward single-resource attribute check. The Sentinel version iterates over aws_dms_endpoint resources and rejects any resource whose ssl_mode is not in an allowlist. tfpolicy can express the same intent directly with one resource_policy, one allowlist, and one enforce block.

Key translation notes

• Sentinel collection.reject() becomes one positive condition
• maps.get(res, "values.ssl_mode", null) becomes core::try(attrs.ssl_mode, "")
• No cross-resource logic, state inspection, or reference metadata is involved

Limitations encountered

No significant tfpolicy limitation blocks this conversion.