S3 Bucket Should Have Object Lock Enabled Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: s3-bucket-should-have-object-lock-enabled.sentinel
2# Exact conversion quality: Limited
3
4locals {
5    all_object_lock_configs = core::getresources("aws_s3_bucket_object_lock_configuration", {})
6    object_lock_bucket_map = {
7        for config in local.all_object_lock_configs :
8        core::try(config.bucket, "") => core::try(config.rule[0].default_retention[0].mode, "")
9    }
10}
11
12resource_policy "aws_s3_bucket" "s3_bucket_should_have_object_lock_enabled" {
13    locals {
14        bucket_name = core::try(attrs.bucket, "")
15        retention_mode = core::try(local.object_lock_bucket_map[local.bucket_name], "")
16        object_lock_enabled = core::contains(["GOVERNANCE", "COMPLIANCE"], local.retention_mode)
17    }
18
19    enforce {
20        condition = local.object_lock_enabled
21        error_message = "S3 buckets should have object lock enabled with default retention mode GOVERNANCE or COMPLIANCE"
22    }
23}