Sentinel Policy to Deny Deployment of Specific Resource Types

denied-resources.sentinel

# This policy uses the tfconfig/v2 import to deny resources
# from an denied list

# Import common-functions/tfconfig-functions/tfconfig-functions.sentinel
# with alias "config"
import "tfconfig-functions" as config

# List of denied resources
denied_list = ["aws_instance", "azurerm_virtualmachine", "google_compute_instance"]

# Get all Resources
allResources = config.find_all_resources()

# Filter to resources with violations
# Warnings will be printed for all violations since the last parameter is true
violatingResources = config.filter_attribute_in_list(allResources, "type", denied_list, true)

# Main rule
main = rule {
 length(violatingResources["messages"]) is 0
}