EC2 VPC Default Security Group No Traffic Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: ec2-vpc-default-security-group-no-traffic.sentinel
2# Exact conversion quality: Not convertible
3# This tfpolicy only checks inline ingress/egress on aws_default_security_group resources.
4
5resource_policy "aws_default_security_group" "ec2_vpc_default_security_group_no_traffic" {
6    locals {
7        ingress_rules = core::try(attrs.ingress, [])
8        egress_rules = core::try(attrs.egress, [])
9    }
10
11    enforce {
12        condition = core::length(local.ingress_rules) == 0
13        error_message = "Default security groups should not allow inline ingress traffic"
14    }
15
16    enforce {
17        condition = core::length(local.egress_rules) == 0
18        error_message = "Default security groups should not allow inline egress traffic"
19    }
20}