in guard/src/rules/parser.rs [1122:1146]
fn clauses(input: Span) -> IResult<Span, Conjunctions<GuardClause>> {
cnf_clauses(
input,
//
// Order does matter here. Both rule_clause and access clause have the same syntax
// for the first part e.g
//
// s3_encrypted_bucket or configuration.containers.*.port == 80
//
// the first part is a rule clause and the second part is access clause. Consider
// this example
//
// s3_encrypted_bucket or bucket_encryption EXISTS
//
// The first part if rule clause and second part is access. if we use the rule_clause
// to be first it would interpret bucket_encryption as the rule_clause. Now to prevent that
// we are using the alt form to first parse to see if it is clause and then try rules_clause
//
alt((clause, rule_clause)),
//
// Mapping the GuardClause
//
std::convert::identity, false)
}