This is a proof of concept for managing ASG 'tag' property with Sentinel, which for some reason is completely different than every other reasource.

It doesn't handle multiple required keys, but neither did the original: https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/check-ec2-environment-tag.sentinel

Mandatory tags should probably be a map that contains a list of acceptable values. rather than a list for the sake of associating things e.g., mandatory_tags = { "Environments: [prod, dev, qa]"}