intel-azurerm-mysql-flexible-server-deny-unapproved-instance-types.sentinel

import "tfplan/v2" as tfplan
import "approved"
import "policy_summary"

param valid_actions default [
	["no-op"],
	["create"],
	["update"],
]

doc = {
	"allowed":   approved.azuremysql,
	"category":  "Infrastructure (IaaS)",
	"error":     " is not an allowed server type.",
	"file_name": "intel-azurerm-mysql-flexible-server-deny-unapproved-instance-types.sentinel",
	"name":      "mysql01",
	"md_url":    "https://github.com/intel/terraform-intel-azure-mysql-flexible-server/blob/main/policies.md",
	"parameter": "sku_name",
	"provider":  "hashicorp/azurerm",
	"resource":  "azurerm_mysql_flexible_server",
	"violation": "The configured server type should use an Intel Xeon 3rd Generation Scalable processor (code-named Ice Lake)",
}

// Filter resources by type
all_resources = filter tfplan.resource_changes as _, rc {
	rc.type is doc.resource and
		rc.mode is "managed" and
		rc.change.actions in valid_actions
}

// Filter resources that violate a given condition
violators = filter all_resources as _, r {
	r.change.after.sku_name else [] not in doc.allowed
}

// Build a summary report
summaryreport = {
	"name": doc.name,
	"violations": map violators as _, violation {
		{
			"name":    violation.name,
			"address": violation.address,
			"type":    violation.type,
			"message": violation.change.after.sku_name + doc.error,
		}
	},
}

main = rule {
	policy_summary.summary(summaryreport, doc)
}