Hashicorp has a tool/framework for this, Sentinel https://www.hashicorp.com/sentinel/

I haven't used it in production. It uses an even-more-baroque syntax than terraform's HCL dialect, and using it kind of assumes that all your modifications go through terraform.