Operational Rule Definitions

module "example" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&rules=lifecycle_ignore_ami_changes"
}

rule "lifecycle_ignore_ami_changes" {
  description = "Ignore AMI changes on EC2 instances to prevent unnecessary replacements"
  severity    = "warning"

  param "ignore_changes" {
    type        = "list(string)"
    default     = ["ami", "image_id"]
    description = "Lifecycle attributes to ignore"
  }

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_instance", "aws_launch_template"]
    description = "Target resource type patterns"
  }

  transformer "lifecycle" {
    action         = "add"
    ignore_changes = param.ignore_changes
    resource_types = param.resource_types
  }
}

rule "lifecycle_ignore_autoscaling_changes" {
  description = "Ignore autoscaling-managed capacity on DynamoDB tables to prevent drift"
  severity    = "warning"

  param "ignore_changes" {
    type        = "list(string)"
    default     = ["read_capacity", "write_capacity"]
    description = "Lifecycle attributes to ignore"
  }

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_dynamodb_table"]
    description = "Target resource type patterns"
  }

  transformer "lifecycle" {
    action         = "add"
    ignore_changes = param.ignore_changes
    resource_types = param.resource_types
  }
}

rule "lifecycle_ignore_tag_keys" {
  description = "Ignore drift on specific resource tag keys (e.g. an external scanner tag) via lifecycle ignore_changes, without exposing an arbitrary lifecycle value"
  severity    = "warning"
  family      = "lifecycle_ignore_tags"

  param "tag_keys" {
    type        = "list(string)"
    default     = []
    description = "AWS tag keys to ignore drift on. Each is emitted as ignore_changes = [tags[\"<key>\"]] with safe literal encoding; empty = unconfigured no-op"
  }

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_s3_bucket"]
    description = "Target resource type patterns. A module with none of these is not applicable"
  }

  transformer "lifecycle" {
    action         = "add"
    resource_types = param.resource_types
  }
}

rule "lifecycle_ignore_tags" {
  description = "Ignore tag changes in lifecycle to prevent Terraform drift on managed resources"
  severity    = "warning"

  param "ignore_changes" {
    type        = "list(string)"
    default     = ["tags", "tags_all"]
    description = "Lifecycle attributes to ignore"
  }

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_*"]
    description = "Target resource type patterns"
  }

  transformer "lifecycle" {
    action         = "add"
    ignore_changes = param.ignore_changes
    resource_types = param.resource_types
  }
}

rule "lifecycle_prevent_destroy_data" {
  description = "Prevent accidental destruction of data-storage resources (S3, RDS instances and clusters, DynamoDB, EFS, ElastiCache replication groups)"
  severity    = "error"

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_s3_bucket", "aws_db_instance", "aws_rds_cluster", "aws_dynamodb_table", "aws_efs_file_system", "aws_elasticache_replication_group"]
    description = "Data-storage resource types to protect"
  }

  transformer "lifecycle" {
    action          = "add"
    prevent_destroy = true
    resource_types  = param.resource_types
  }
}

rule "lifecycle_prevent_destroy_encryption" {
  description = "Prevent destruction of KMS keys and Secrets Manager secrets"
  severity    = "error"

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_kms_key", "aws_secretsmanager_secret"]
    description = "Encryption resource types to protect"
  }

  transformer "lifecycle" {
    action          = "add"
    prevent_destroy = true
    resource_types  = param.resource_types
  }
}

rule "provisioner_remove_blocks" {
  description = "Remove provisioner blocks which are an anti-pattern in reusable modules"
  severity    = "warning"

  param "resource_types" {
    type        = "list(string)"
    default     = ["*"]
    description = "Target resource type patterns"
  }

  transformer "block_removal" {
    block_type = "provisioner"
  }
}

rule "resource_restrict_instance_types" {
  description = "Restrict EC2 instance types to cost-effective options"
  severity    = "error"

  param "denied" {
    type        = "list(string)"
    default     = ["p3.*", "p4.*", "x1.*", "x2.*", "u-*"]
    description = "Denied instance type patterns"
  }

  param "message" {
    type        = "string"
    default     = "GPU and high-memory instance types are not permitted without approval"
    description = "Validation error message"
  }

  transformer "attribute_restriction" {
    resource_type = "aws_instance"
    attribute     = "instance_type"
    denied        = param.denied
    message       = param.message
  }
}

rule "variable_allowed_regions" {
  description = "Restrict the module's region variable to an org-approved allowlist"
  severity    = "error"

  param "regions" {
    type        = "list(string)"
    default     = []
    description = "Allowed AWS regions (enumerated, no globs). Empty = unconfigured: the rule injects nothing and enforces nothing"
  }

  param "allow_unset" {
    type        = "bool"
    default     = false
    description = "Accept a null region (provider-inherited). Unenforced by consent - it does not permit a wrong region"
  }

  param "variable_name" {
    type        = "string"
    default     = "region"
    description = "Name of the module variable carrying the region"
  }

  param "resource_types" {
    type        = "list(string)"
    default     = ["aws_*"]
    description = "Resource types this rule applies to. A module with none is not applicable"
  }

  transformer "variable_assertion" {
    variable      = param.variable_name
    condition     = "var.{{variable}} == null ? {{allow_unset}} : contains({{values}}, var.{{variable}})"
    error_message = "Variable \"{{variable}}\" must be one of the regions allowed by your organization: {{values}}. An empty or unknown value is rejected."
    allow_unset   = param.allow_unset
  }
}