Elasticsearch Encrypted At REST Policy

1# Converted from HashiCorp PCI DSS Sentinel example: elasticsearch-encrypted-at-rest.sentinel
2# Conversion quality: Good
3
4resource_policy "aws_elasticsearch_domain" "elasticsearch_encrypted_at_rest" {
5    locals {
6        encrypt_at_rest = core::try(attrs.encrypt_at_rest, [])
7        encryption_enabled = core::try(local.encrypt_at_rest[0].enabled, false)
8    }
9
10    enforce {
11        condition = local.encryption_enabled == true
12        error_message = "Elasticsearch domains must enable encrypt_at_rest"
13    }
14}