Dms Endpoints Should Use SSL Policy

1# Converted from HashiCorp PCI DSS Sentinel example: dms-endpoints-should-use-ssl.sentinel
2# Conversion quality: Perfect
3
4resource_policy "aws_dms_endpoint" "require_ssl_mode" {
5    locals {
6        ssl_mode = core::try(attrs.ssl_mode, "")
7        valid_ssl_modes = ["require", "verify-ca", "verify-full"]
8    }
9
10    enforce {
11        condition = core::contains(local.valid_ssl_modes, local.ssl_mode)
12        error_message = "DMS endpoints must set ssl_mode to one of: require, verify-ca, verify-full"
13    }
14}