Elasticsearch In VPC Only Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: elasticsearch-in-vpc-only.sentinel
2# Exact conversion quality: Limited
3
4resource_policy "aws_elasticsearch_domain" "elasticsearch_in_vpc_only" {
5    locals {
6        vpc_options = core::try(attrs.vpc_options, [])
7        subnet_ids = core::try(local.vpc_options[0].subnet_ids, [])
8    }
9
10    enforce {
11        condition = core::length(local.subnet_ids) > 0
12        error_message = "Elasticsearch domains should define one or more subnet_ids in vpc_options"
13    }
14}