Compare Sentinel and OPA (Open Policy Agent) for Terraform policy enforcement. How would you implement a policy that prevents any S3 bucket from being created without encryption, versioning, and a lifecycle policy?

# OPA/Rego policy: Enforce S3 encryption, versioning, and lifecycle
# policies/s3_compliance.rego
package terraform.s3

import rego.v1

resource_changes := input.resource_changes

s3_buckets := [rc |
  rc := resource_changes[_]
  rc.type == "aws_s3_bucket"
  rc.change.actions[_] == "create"
]

# Check encryption is enabled
deny contains msg if {
  bucket := s3_buckets[_]
  not has_encryption(bucket.change.after)
  msg := sprintf("S3 bucket '%s' must have server-side encryption enabled", [bucket.address])
}

# Check versioning is enabled
deny contains msg if {
  bucket := s3_buckets[_]
  not has_versioning(bucket.change.after)
  msg := sprintf("S3 bucket '%s' must have versioning enabled", [bucket.address])
}

has_encryption(config) if {
  config.server_side_encryption_configuration[_].rule[_].apply_server_side_encryption_by_default[_].sse_algorithm
}

has_versioning(config) if {
  config.versioning[_].enabled == true
}

# Run with conftest
# terraform plan -out=plan.tfplan
# terraform show -json plan.tfplan > plan.json
# conftest test plan.json --policy ./policies/ --output table

# Sentinel equivalent (for Terraform Cloud)
# s3_encryption.sentinel
import "tfplan/v2" as tfplan

s3_buckets = filter tfplan.resource_changes as _, rc {
  rc.type is "aws_s3_bucket" and
  rc.change.actions contains "create"
}

encryption_enabled = rule {
  all s3_buckets as _, bucket {
    bucket.change.after.server_side_encryption_configuration is not empty
  }
}

main = rule {
  encryption_enabled
}

# GitHub Actions integration
# - name: Policy Check
#   run: |
#     terraform show -json plan.tfplan > plan.json
#     conftest test plan.json --policy ./policies/ --output json
#     if [ $? -ne 0 ]; then echo "Policy violations found"; exit 1; fi