let vpc_subnets = Resources.*[
	Type == "AWS::EC2::Subnet"
]

rule vpc_auto_assign_ip_disabled when %vpc_subnets !empty {
	%vpc_subnets {
		Properties {
			MapPublicIpOnLaunch not exists OR
			MapPublicIpOnLaunch exists
			when MapPublicIpOnLaunch exists {
				MapPublicIpOnLaunch == false <<MapPublicIpOnLaunch is enabled.>>
			}
		}
	}
}