Adding 2 policies to check workspace versions are greater than or equ…

README.md

@@ -63,6 +63,8 @@ Many policies contain arrays of values that are checked against resources. The a
 | [management/workspace_name.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/management/workspace_name.rego) | Simple example of using `tfrun` data and validating a workspace name.    |
 | [management/workspace_destroy.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/management/workspace_destroy.rego) | Checks workspace has an active state and denies its destroy, if active state is present.    |
 | [management/workspace_tags.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/management/workspace_tags.rego) | Checks workspace is tagged with provider name.                           |
+| [management/terraform_min_version.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/management/terraform_min_version.rego) | Checks the workspace is not using an older version of Terraform.                           |
+| [management/terraform_min_version.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/management/terraform_min_version.rego) | Suggests when a workspace is should be using a newer version of Terraform                          |
 | [modules/pin_module_version.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/modules/pin_module_version.rego) | Enforces use of specific module versions.                                |
 | [modules/required_modules.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/modules/required_modules.rego) | Checks resources are only be created via specific modules.               |
 | [placement/cloud_location.rego](https://github.com/Scalr/sample-tf-opa-policies/blob/master/placement/cloud_location.rego) | Checks resources are deployed to specific regions in each cloud.         |

management/terraform_min_version.rego

@@ -0,0 +1,14 @@
+package terraform
+
+import input.tfplan as tfplan
+
+min_version = "1.0.0"
+
+# Matches that minimum version is met
+deny[reason] {
+	version := tfplan.terraform_version
+
+	version < min_version
+
+	reason := sprintf("Terraform version %s is not allowed. Please pick a version equal to or greater than %s", [version, min_version])
+}

management/terraform_min_version_mock.json

@@ -0,0 +1,16 @@
+{
+   "mock":{
+      "not_allowed_version":{
+         "tfplan":{
+            "format_version":"0.1",
+            "terraform_version":"0.13.0"
+         }
+      },
+      "allowed_version":{
+         "tfplan":{
+            "format_version":"0.1",
+            "terraform_version":"1.3.5"
+         }
+      }
+   }
+}

management/terraform_min_version_test.rego

@@ -0,0 +1,11 @@
+package terraform
+
+test_not_allowed_versions {
+	result = deny with input as data.mock.not_allowed_version
+	count(result) == 1
+}
+
+test_allowed_versions {
+	result = deny with input as data.mock.allowed_version
+	count(result) == 0
+}

management/terraform_suggested_version.rego

@@ -0,0 +1,14 @@
+package terraform
+
+import input.tfplan as tfplan
+
+suggested_version = "1.3.5"
+
+# Matches that minimum version is met
+suggested["Suggested version"] {
+	version := tfplan.terraform_version
+
+	version < suggested_version
+
+	reason := sprintf("Terraform version %s will soon be deprecated. Please migrate to version %s", [version, suggested_version])
+}

management/terraform_suggested_version_mock.json

@@ -0,0 +1,16 @@
+{
+   "mock":{
+      "not_suggested_version":{
+         "tfplan":{
+            "format_version":"0.1",
+            "terraform_version":"0.13.0"
+         }
+      },
+      "suggested_version":{
+         "tfplan":{
+            "format_version":"0.1",
+            "terraform_version":"1.3.5"
+         }
+      }
+   }
+}

management/terraform_suggested_version_test.rego

@@ -0,0 +1,11 @@
+package terraform
+
+test_not_suggested_versions {
+	result = suggested with input as data.mock.not_suggested_version
+	count(result) == 1
+}
+
+test_suggested_versions {
+	result = suggested with input as data.mock.suggested_version
+	count(result) == 0
+}