conftest verify is unexpectedly passing

[madsonic]

Running conftest verify resulted in a pass even though the rule should have failed at db.storage_encrypted != true. I can't seem to understand why this happens, what am I missing here?

# deny.rego
deny_unencrypted[msg] {
  db := input.resource.aws_db_instance[x]
  db.storage_encrypted != true                     # should fail here
  msg = sprintf("RDS `%v` has unencrypted storage", [x])
}

# deny_test.rego
test_caseone {
  cfg := parse_config("hcl2", `
    resource "aws_db_instance" "default" {
      storage_encrypted = true
    }
  `)

   deny_unencrypted with input as cfg
}

[anderseknert]

Answered on SO, as I saw it there first :)

https://stackoverflow.com/questions/76209824/conftest-verify-is-unexpectedly-passing/76210538#76210538