Include all the input properties (the default value if not specified) in the global input variable for policy checking

[XuejiaoZhang]

OPA policy written

For example,
here is the input variable of a S3 Bucket resource:
[mandatory] s3 v0.0.1 deny (aws:s3/bucket:Bucket: my-bucket)
input: {"acl": "private", "bucket": "my-bucket-395bxxx", "forceDestroy": false}

here is the input variable of a EBS Volume resource:
[mandatory] s3 v0.0.1 deny (aws:ebs/volume:Volume: example)
input: {"tags": {"Name": "HelloWorld"}, "availabilityZone": "us-east-1a", "size": 40}

I was expecting all the input properties of S3 Bucket, and all the input properties of EBS Volume included in the input variable, it seems only the configurations specified in the definition of the resource will be shown. If the properties not specified can be included with the default value will help to write policies.

[leezen]

This makes sense. For your particular use case, would using stack validation be a potential workaround? https://www.pulumi.com/docs/guides/crossguard/core-concepts/#resource-validation-vs-stack-validation -- at this point, the outputs are available so the values you'd be interested in should be inspectable (admittedly, the resource will have been created, but in some use cases, this might be fine).