c7n-terraform

from c7n_terraform.provider import TerraformProvider from c7n.policy import Policy, PolicyCollection import json provider = TerraformProvider() # Load a Terraform plan file (JSON output of terraform plan -out=plan.tfplan) with open('plan.json') as f: resources = provider.parse(json.load(f)) # Define a policy to check for unencrypted S3 buckets policy_data = { 'name': 's3-no-encryption', 'resource': 'terraform.aws_s3_bucket', 'filters': [{'type': 'value', 'key': 'server_side_encryption_configuration', 'value': None}], 'actions': [{'type': 'notify', 'to': ['devnull'], 'subject': 'Compliance', 'message': 'Bucket {} has no encryption'}] } policy = Policy(policy_data, {}) results = provider.run([policy], resources) for r in results: print(r['resource']['id'])