README

efs-access-point-should-enforce-user-identity.sentinel

Conversion Quality

Perfect

Why it converts well

This is a simple presence check on a single planned resource type. The Sentinel policy rejects aws_efs_access_point resources that do not define posix_user, and tfpolicy can express that directly with one resource_policy and one enforce block.

Key translation notes

• maps.get(res.values, "posix_user", {}) is not empty becomes core::try(attrs.posix_user, null) != null
• No cross-resource reasoning or reference metadata is required

Limitations encountered

No significant tfpolicy limitation blocks this conversion.