What is the purpose of the module/data checking?

[domeales-paloit]

Hi @mjlshen

Great job on these policies.

Just a question, I am wondering what is the purpose of the module/data deny check? I am not sure I understand the logic here.

Cheers

[mjlshen]

No worries! If you are referring to this: https://github.com/mjlshen/terraform-aws-opa/blob/main/policy/aws_common.rego#L94

Sometimes organizations mandate that developers need to use internal Terraform modules (or data), but aren't allowed to use vanilla resources as a way to restrict what's allowed. This is just an example of how one might write that restriction into Rego 😅

[domeales-paloit]

Ok that makes sense, I can see how that may be useful in certain scenarios.

Thanks again!