Skip to content

fix: Simplify enforce instance type policy by using sets #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KNiepok merged 1 commit into from
Feb 24, 2026
Merged

fix: Simplify enforce instance type policy by using sets #67

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 5 additions & 15 deletions examples/plan/enforce-instance-type-list.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,18 +7,18 @@ import rego.v1
# the instance type.

# Define the deny list of instance types
deny_list := ["t2.2xlarge", "t2.xlarge"]
deny_list := {"t2.2xlarge", "t2.xlarge"}

# Define the allow list of instance types
allow_list := ["t2.nano", "t2.micro", "t2.small"]
allow_list := {"t2.nano", "t2.micro", "t2.small"}

# Deny if the instance type is in the deny list
deny contains sprintf(message, [resource.address, instance]) if {
message := "Instance type %s is not allowed (%s)"
resource := input.terraform.resource_changes[_]
resource.type == "aws_instance"
instance := resource.change.after.instance_type
is_in_deny_list(instance)
deny_list[instance]
}

# Warn if the instance type is not in the allow or deny lists
Expand All @@ -27,18 +27,8 @@ warn contains sprintf(message, [resource.address, instance]) if {
resource := input.terraform.resource_changes[_]
resource.type == "aws_instance"
instance := resource.change.after.instance_type
not is_in_allow_list(instance)
not is_in_deny_list(instance)
}

# Helper function to check if instance type is in the allow list
is_in_allow_list(instance) if {
instance in allow_list
}

# Helper function to check if instance type is in the deny list
is_in_deny_list(instance) if {
instance in deny_list
not allow_list[instance]
not deny_list[instance]
}

# Learn more about sampling policy evaluations here:
Expand Down