# This policy requires resources of type `aws_efs_access_point` have attribute `posix_user` should be defined.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants

const = {
	"policy_name":                   "efs-access-point-should-enforce-user-identity",
	"message":                       "Attribute 'posix_user' should be defined for 'aws_efs_access_point' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/efs-controls.html#efs-4 for more details.",
	"resource_aws_efs_access_point": "aws_efs_access_point",
	"posix_user":                    "posix_user",
}

# Variables

resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_efs_access_point).resources

violations = collection.reject(resources, func(res) {
	return maps.get(res.values, const.posix_user, {}) is not empty
})

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}