apiVersion: atmos/v1
kind: Policy
metadata:
  name: terraform-disallow-resource-types
  description: "Prevent selected resource types from being created or retained by a change."
spec:
  policies:
    disallow-resource-types:
      on: terraform.plan
      engine: starlark
      action: deny
      reason: Long-lived IAM users and access keys are not permitted
      with:
        types:
          - aws_iam_user
          - aws_iam_access_key
      rule: |
        for resource in ctx.input.get("resource_changes", []):
            if resource["mode"] == "managed" and resource["type"] in ctx.params["types"] and resource["change"]["after"] != None:
                return True
        return False