GUARDRAIL "Require encrypted environment variables in Google Cloud Function"
  WHEN google_cloudfunctions_function
    REQUIRE kms_key_name EXISTS

import "tfplan/v2" as tfplan

# Main rule that must evaluate to true for the policy to pass
main = rule {
    all_cloud_functions_have_kms_key
}

# Rule: Ensure all Google Cloud Functions have 'kms_key_name' set
all_cloud_functions_have_kms_key = all tfplan.resources.google_cloudfunctions_function as _, function {
    # 'kms_key_name' must be set and not empty
    function.applied.kms_key_name is string and
    function.applied.kms_key_name != ""
}