apiVersion: atmos/v1
kind: Policy
metadata:
  name: terraform-require-owner-tag
  description: "Require a known, nonempty Owner tag on planned EC2 instances."
spec:
  policies:
    require-owner-tag:
      on: terraform.plan
      engine: starlark
      action: deny
      reason: Managed EC2 instances require a known nonempty Owner tag
      rule: |
        for resource in ctx.input.get("resource_changes", []):
            if resource["mode"] != "managed" or resource["type"] != "aws_instance":
                continue
            change = resource["change"]
            after = change["after"]
            if after == None:
                continue
            tags = after.get("tags")
            if tags == None or "Owner" not in tags or tags["Owner"] == None or tags["Owner"] == "":
                return True
            unknown_tags = change.get("after_unknown", {}).get("tags")
            if unknown_tags == True or (unknown_tags != None and unknown_tags != False and unknown_tags.get("Owner") == True):
                return True
        return False