We've been using Sentinel by Hashicorp with great success for this. The language is a little awkward at times, but it has deep integration with Terraform - our

We've been using Sentinel by Hashicorp with great success for this. The language is a little awkward at times, but it has deep integration with Terraform - our policy rules have access to the entire terraform state, the details of the plan/apply, etc. It lets us write very granular rules, even rules correlating different resources which would be difficult with a semgrep approach (for instance we have a rule that you can't create a route53 hosted zone without also enabling logging for the zone. The logging is a separate resource, not an attribute of the hosted zone resource).