Elasticsearch Encrypted at Rest
Source Sentinel Policy
elasticsearch-encrypted-at-rest.sentinel
Conversion Quality
Good
Why this is Good
The original intent maps cleanly to tfpolicy, but the block shape still has to be rewritten in tfpolicy terms using core::try() around encrypt_at_rest[0].enabled.
Key translation notes
- Nested map access becomes direct tfpolicy block access
- The conversion checks the planned end state of
encrypt_at_rest - The outcome is preserved even though the syntax changes substantially
Limitations encountered
This depends on the provider exposing encrypt_at_rest in the expected block/list structure. As with other tfpolicy policies, raw provider schema shape matters.