README

s3-block-public-access-bucket-level.sentinel

Conversion Quality

Not convertible as an exact translation

What the approximation does

The tfpolicy approximation checks whether an aws_s3_bucket has a matching aws_s3_bucket_public_access_block resource and whether all four public access settings are enabled.

Why exact conversion is not possible today

The Sentinel policy combines:

• tfconfig/v2
• tfconfig-functions
• plan-time variable resolution
• config reference metadata
• module-aware address reconstruction

Current tfpolicy guidance does not expose that full config-analysis surface. In particular, tfpolicy cannot safely reproduce the Sentinel behavior that inspects variable references and configuration graph relationships before values are fully materialized.

Limitations encountered

• The approximation relies on resolved values via core::getresources()
• It cannot reproduce variable-reference evaluation from the Sentinel policy
• It may differ from Sentinel on first creation or heavily parameterized module usage