Inline Value with Comment

Set the attribute to a default value and add an inline comment listing all valid options. Useful when engineers should see alternatives without leaving the file.

Prompt

The following can be used with the gomboc-enterprise-skills.

/gomboc:fix

I want to create an ORL rule that checks that the AMI used for EC2 instances or launch configurations is one of the following:

- ami-0a1b2c3d4e5f67890
- ami-0987654321fedcba0
- ami-0ff11223344556677
- ami-0abcdef1234567890
- ami-0123456789abcdef0

If the value is not one of those, then use the first one listed as the value.  Then add an inline comment after the value with all the values pipe-separated (`|`).

Use /gomboc-community:fix if you have the gomboc-community-skills installed.

Specify both the default value and the comment format (pipe-separated list).

Rule Output Example

---
type: Ruleset
version: v1
metadata:
  name: enforce-approved-ami
  description: |
    Ensures that aws_instance and aws_launch_configuration resources use only approved AMI IDs.
spec:
  template:
    language: terraform
    audit_language: ast
  rules:
    - name: enforce-approved-ami-aws-instance
      audit: |
        {{ aResource("aws_instance", anAttributeValue("ami", "(#not-match? @value \"ami-0a1b2c3d4e5f67890|ami-0987654321fedcba0|ami-0ff11223344556677|ami-0abcdef1234567890|ami-0123456789abcdef0\")")) }}
      remediation:
        - command: replace
          path: value
          value: '"ami-0a1b2c3d4e5f67890" # ami-0a1b2c3d4e5f67890 | ami-0987654321fedcba0 | ami-0ff11223344556677 | ami-0abcdef1234567890 | ami-0123456789abcdef0'

    - name: enforce-approved-ami-aws-launch-configuration
      audit: |
        {{ aResource("aws_launch_configuration", anAttributeValue("image_id", "(#not-match? @value \"ami-0a1b2c3d4e5f67890|ami-0987654321fedcba0|ami-0ff11223344556677|ami-0abcdef1234567890|ami-0123456789abcdef0\")")) }}
      remediation:
        - command: replace
          path: value
          value: '"ami-0a1b2c3d4e5f67890" # ami-0a1b2c3d4e5f67890 | ami-0987654321fedcba0 | ami-0ff11223344556677 | ami-0abcdef1234567890 | ami-0123456789abcdef0'

Each rule audits one resource type. Invalid AMIs are replaced with the first allowlisted value and an inline comment showing every option.