This message was deleted.

Hmm you may want to use

conftest

with opa to see if there are any resources to delete.

Thanks, I'll take a look.

We’re doing exactly that with resources where a destroy would result in dataloss (like dynamo tables).

there's a default example for calculating blast radius which can be adjusted to do exactly that https://www.openpolicyagent.org/docs/latest/terraform/#3-write-the-opa-policy-to-check-the-plan

I think trivy (modern version of tfsec) also supports opa based rules • https://aquasecurity.github.io/trivy/v0.49/docs/scanner/misconfiguration/policy/builtin/ • https://github.com/aquasecurity/trivy-policies/tree/main/checks/cloud/aws • https://aquasecurity.github.io/trivy/v0.49/docs/scanner/misconfiguration/custom/

I'm really bad at checking this Slack team. Thanks a lot, @Ed, @Gabor Maghera and @RB