Expose attached integrations to the policy engine

Our centralized team is managing integrations for the decentralized engineers/developers.

We want to provide a privileged integration, which should only be available if the stack is using whitelisted Terraform modules (enforced by policy).

We have the policy in place, but we're missing the required metadata to detect which integration is attached to the stack.

Our current goal:

Only allow the use whitelisted modules if the privileged integration (labeled “privileged”) is attached to the stack.

This is an example that would be nice if it would work:

import rego.v1

# This is currently not possible/available
# data like this would be helpful to build policies based on the attached
# integrations:
# integrations := [
#   {
#     id: "privileged-integration"
#     type: "azure"
#     name: "My Privileged Integration"
#     labels: ["privileged"]
#   },
# ]
integrations := input.run.integrations

deny contains msg if {
	some integration in integrations
	"privileged" in integration.labels
	msg := sprintf("integration %q is labeled privileged", [integration.id])
}