Step Functions State Machine Logging Enabled Policy

1# Converted from HashiCorp PCI DSS Sentinel example: step-functions-state-machine-logging-enabled.sentinel
2# Conversion quality: Good
3
4resource_policy "aws_sfn_state_machine" "step_functions_state_machine_logging_enabled" {
5    locals {
6        logging_configuration = core::try(attrs.logging_configuration, [])
7        log_level = core::try(local.logging_configuration[0].level, "")
8        allowed_levels = ["ALL", "ERROR", "FATAL"]
9    }
10
11    enforce {
12        condition = core::contains(local.allowed_levels, local.log_level)
13        error_message = "Step Functions state machines must set logging_configuration.level to ALL, ERROR, or FATAL"
14    }
15}