EC2 Network Acl Should Have Subnet Ids Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: ec2-network-acl-should-have-subnet-ids.sentinel
2# Exact conversion quality: Limited
3
4locals {
5    all_network_acl_associations = core::getresources("aws_network_acl_association", {})
6    associated_network_acl_ids = {
7        for association in local.all_network_acl_associations :
8        core::try(association.network_acl_id, "") => true
9    }
10}
11
12resource_policy "aws_network_acl" "network_acl_should_have_subnet_ids" {
13    locals {
14        subnet_ids = core::try(attrs.subnet_ids, [])
15        has_subnet_ids = core::length(local.subnet_ids) > 0
16        network_acl_id = core::try(attrs.id, "")
17        has_association = core::try(local.associated_network_acl_ids[local.network_acl_id], false)
18    }
19
20    enforce {
21        condition = local.has_subnet_ids || local.has_association
22        error_message = "Network ACLs should define subnet_ids directly or have a matching aws_network_acl_association"
23    }
24}