elasticsearch-domains-encryption-must-be-enabled.sentinel

# This policy uses the Sentinel tfplan/v2 import to require that
# All elasticsearch domains are encrypted at rest and nodes encrypted end-to-end

# Import common-functions/tfplan-functions/tfplan-functions.sentinel
# with alias "plan"
import "tfplan-functions" as plan

# Get all cloudtrails
allElasticDomains = plan.find_resources("aws_elasticsearch_domain")

# Filter to elastic domains that are not encrypted
# Warnings will be printed for all violations since the last parameter is true

nonEncryptedElasticDomains = plan.filter_attribute_is_not_value(allElasticDomains,
	"encrypt_at_rest.0.enabled",
	true, false)

nonEncryptedElasticDomainsNodes = plan.filter_attribute_is_not_value(allElasticDomains,
	"node_to_node_encryption.0.enabled",
	true, false)

# Main rule
validated = length(nonEncryptedElasticDomains["messages"]) is 0 and length(nonEncryptedElasticDomainsNodes["messages"]) is 0
main = rule {
	validated is true
}