Secretsmanager Auto Rotation Enabled Check Policy

1# Approximation of HashiCorp PCI DSS Sentinel example: secretsmanager-auto-rotation-enabled-check.sentinel
2# Exact conversion quality: Limited
3
4locals {
5    all_secret_rotations = core::getresources("aws_secretsmanager_secret_rotation", {})
6    rotation_secret_ids = {
7        for rotation in local.all_secret_rotations :
8        core::try(rotation.secret_id, "") => true
9    }
10}
11
12resource_policy "aws_secretsmanager_secret" "secretsmanager_auto_rotation_enabled_check" {
13    locals {
14        secret_id = core::try(attrs.id, "")
15        has_rotation = core::try(local.rotation_secret_ids[local.secret_id], false)
16    }
17
18    enforce {
19        condition = local.has_rotation
20        error_message = "Secrets Manager secrets should have a matching aws_secretsmanager_secret_rotation resource"
21    }
22}