Initial CrossGuard Policy

index.ts

import * as aws from '@pulumi/aws';

import { PolicyPack, ReportViolation, validateResourceOfType } from '@pulumi/policy';

new PolicyPack('aws', {
  policies: [
    {
      name: 'required-tags',
      description: 'Certain tags are required.',
      enforcementLevel: 'mandatory',
      validateResource: [
        validateResourceOfType(aws.iam.User, (user, args, reportViolation) => {
          requireCreatorTag(user.tags, reportViolation);
        }),
      ],
    },
  ],
});

function requireCreatorTag(tags: any, reportViolation: ReportViolation) {
  if ((tags || {})['Creator'] === undefined) {
    reportViolation(`A 'Creator' tag is required.`);
  }
}