Policy Setting: AWS > EFS > Mount Target > Approved > Custom

resource "turbot_policy_setting" "aws_efs_mount_target_approved_custom" {
  resource       = turbot_policy_pack.main.id
  type           = "tmod:@turbot/aws-efs#/policy/types/mountTargetApprovedCustom"
  note           = "AWS CIS v3.0.0 - Control: 2.4.1"
  template_input = <<-EOT
    {
      mountTarget {
        parent {
          encrypted: get(path:"Encrypted")
        }
      }
    }
    EOT
  template       = <<-EOT
    {%- if $.mountTarget.parent.encrypted -%}

      {%- set data = {
          "title": "EFS Filesystem Encryption",
          "result": "Approved",
          "message": "Filesystem is encrypted"
      } -%}

    {%- else -%}

      {%- set data = {
          "title": "EFS Filesystem Encryption",
          "result": "Not approved",
          "message": "Filesystem is not encrypted"
      } -%}

    {%- endif -%}
    {{ data | json }}
  EOT
}