Require Encryption with AWS LoadBalancers

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-encryption-aws-loadbalancers
  annotations:
    policies.kyverno.io/title: Require Encryption with AWS LoadBalancers
    policies.kyverno.io/category: AWS, EKS Best Practices
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Service
    kyverno.io/kyverno-version: 1.7.3, 1.8.0-rc2
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: 1.23-1.24
    policies.kyverno.io/description: Services of type LoadBalancer when deployed inside AWS have support for transport encryption if it is enabled via an annotation. This policy requires that Services of type LoadBalancer contain the annotation service.beta.kubernetes.io/aws-load-balancer-ssl-cert with some value.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: aws-loadbalancer-has-ssl-cert
      match:
        any:
          - resources:
              kinds:
                - Service
      validate:
        message: Service of type LoadBalancer must carry the annotation service.beta.kubernetes.io/aws-load-balancer-ssl-cert.
        pattern:
          metadata:
            annotations:
              service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "?*"
          (spec):
            (type): LoadBalancer