block_iam_basic_roles.rego

package spacelift

# Define the forbidden roles
forbidden_roles := {"editor", "owner"}

# Deny when creating or updating a google_project_iam_binding with forbidden roles
deny[sprintf("Resource '%s' has a forbidden role.", [resource.address])] {
    # Select the resource from the input
    resource := input.terraform.resource_changes[_]
    # Check if the resource is a google_project_iam_binding and the action is either create or update
    resource.type == "google_project_iam_binding"
    resource.change.actions[_] == "create"
    
    # Check if the role_key is in the set of forbidden roles
    forbidden_roles[resource.index]
}

# Deny when creating or updating a google_project_iam_binding with forbidden roles
warn[sprintf("Resource '%s' has a forbidden role.", [resource.address])] {
    # Select the resource from the input
    resource := input.terraform.resource_changes[_]
    # Check if the resource is a google_project_iam_binding and the action is either create or update
    resource.type == "google_project_iam_binding"
    resource.change.actions[_] == "update"
    
    # Check if the role_key is in the set of forbidden roles
    forbidden_roles[resource.index]
}