terraform conftest example

terraform-deny_kafka_topic_change.rego

package main
import input

resource_whitelist = {
	"kafka_topic"
}

resource_changes[r] {
	input.resource_changes[_].change.actions[_] != "no-op"
	r := input.resource_changes[_].type
	not resource_whitelist[r]
}

deny[msg] {
	count(resource_changes) > 0
	msg := sprintf("resource type %s is not preapproved", [resource_changes[_]])
}