# This policy requires that the `transit_encryption_enabled` attribute of the `aws_elasticache_replication_group` resource is true.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants
const = {
	"policy_name":                                "elasticache-redis-replication-group-encryption-at-rest-enabled",
	"resource_aws_elasticache_replication_group": "aws_elasticache_replication_group",
}

# Functions
get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		key = "values.transit_encryption_enabled"
		return maps.has(res, key) and maps.get(res, key) is true
	})
}

# Variables

elasticache_replication_groups = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_elasticache_replication_group).resources
violations = get_violations(elasticache_replication_groups)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        "Attribute 'transit_encryption_enabled' must be true for 'aws_elasticache_replication_group' resources.Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/elasticache-controls.html#elasticache-5 for more details.",
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}