rules:
- id: aws-s3-bucket-versioning-not-enabled
  patterns:
  - pattern: |
      resource "aws_s3_bucket" $ANYTHING {
        ...
      }
  - pattern-not-inside: |
      resource "aws_s3_bucket" $ANYTHING {
        ...
        versioning {
          ...
          enabled = true
          ...
        }
        ...
      }
    # filter out unknowns for now
  - pattern-not-inside: |
      resource "aws_s3_bucket" $ANYTHING {
        ...
        versioning {
          ...
          enabled = var.$X
          ...
        }
        ...
      }
  message: >-
    Ensure that Amazon S3 bucket versioning is not enabled. Consider using versioning if you don't have alternative backup mechanism.
  metadata:
    category: best-practice
    technology:
    - terraform
    - aws
  languages: [hcl]
  severity: WARNING