{
  "apiVersion": "json.kyverno.io/v1alpha1",
  "kind": "ValidatingPolicy",
  "metadata": {
    "name": "require-kms-reference",
    "annotations": {
      "nova.cloudinit.dev/severity": "medium",
      "title.policy.kyverno.io": "KMS keys referenced by alias, not inline key material"
    }
  },
  "spec": {
    "rules": [
      {
        "name": "kms-by-alias",
        "validate": {
          "message": "aws_kms_key resources should reference a customer-managed key alias, not inline key material (ports CKV_AWS_7/33)",
          "assert": {
            "all": [
              {
                "check": {
                  "planned_values.root_module.~.resources": {
                    "(type == 'aws_kms_key' && !contains(keys(values), 'key_id') && !contains(keys(values), 'kms_key_id'))": false
                  }
                }
              }
            ]
          }
        }
      }
    ]
  }
}