HashiConf Our community conference is taking place in San Francisco and online October 10-12. Register now
  • Infrastructure
    • terraform
    • packer
  • Networking
    • consul
  • Security
    • vault
    • boundary
  • Applications
    • nomad
    • waypoint
    • vagrant
  • HashiCorp Cloud Platform

    A fully managed platform to automate infrastructure on any cloud with HashiCorp products.

    • consul
    • terraform
    • vault
    • packerbeta
    Visit cloud.hashicorp.com
Sentinel
  • Intro
  • Docs
Download
    • v0.21.x (latest)
    • v0.20.x
    • v0.19.x
    • v0.18.x
    • v0.17.x
    • v0.16.x
    • v0.15.x
    • v0.14.x
    • v0.13.x
  • Release Notes
    • Overview
    • Policy as Code
    • Policy Language
    • Imports
    • Enforcement Levels
    • Overview
    • Override Files
    • Remote Sources
    • Overview
    • apply
    • fmt
    • test
    • Overview
    • Basics
    • Rules
    • Traces
    • Testing
    • Imports
    • Debugging
    • Overview
    • Modules
    • Plugins
    • Static Imports
    • Internals

    • Overview
    • Variables
    • Values
    • Lists
    • Maps
    • Rules
    • Imports
    • Parameters
    • Boolean Expressions
    • Arithmetic
    • Slices
    • Conditionals
    • Loops
    • Collection Operations
    • Functions
    • Scope
    • Undefined
    • Logging and Errors
    • Specification
    • Overview
    • append
    • delete
    • error
    • keys
    • length
    • print
    • range
    • values
    • Overview
    • base64
    • decimal
    • http
    • json
    • runtime
    • sockaddr
    • strings
    • time
    • types
    • units
    • version

  • Consul
  • Nomad
  • Terraform
  • Vault
Type '/' to Search

»Language: Conditionals

Conditional statements allow your policy to behave differently depending on a condition.

Conditional statements may only appear outside of rule expressions, such as in functions or in the global scope of a policy. This is because rules are only allowed to contain a single boolean expression.

»If Statements

if statements only execute their bodies if a condition is met. The syntax of an if statement is:

if condition {
  // ... this is executed if condition is true
}

The condition must result in a boolean, such as by calling a function or evaluating a boolean expression. If the condition is true, the body (within the {}) is executed. Otherwise, the body is skipped.

Examples:

// This would execute the body
value = 12
if value is 18 {
    print("condition met")
}

// Direct boolean values can be used
value = true
if value {
    print("condition met")
}

// This would not execute the body since the boolean expression will
// result in undefined.
value = {}
if value["key"] > 12 {
    print("condition met")
}

»Else, Else If

An else clause can be given to an if statement to execute a body in the case the condition is not met. By putting another if statement directly after the else, multiple conditions can be tested for. The syntax is:

if condition {
    // ...
} else {
    // ...
}

if condition {
    // ...
} else if other_condition {
    // ...
} else {
    // ...
}

»Scoping

The body of an if statement does not create a new scope. Any variables assigned within the body of an if statement will modify the scope that the if statement itself is in.

Example:

if true {
    a = 42
}

print(a) // 42
a = 18
if true {
    a = 42
}

print(a) // 42

»Case Statements

case statements are a selection control mechanism that execute a clause based on matching expressions. It is worth noting that the expression for case is optional. When no expression is provided, it defaults the expression to true. Additionally, the order of clauses is important, as they are evaluated from top to bottom, executing the first match. The syntax of a case statement is:

case expression {
    when clause_expression:
        // executed when clause_expression and expression are equal
    else:
        // executed if no clause matches expression
}

»When Clause

Any clause that has an expression for comparison must use the when keyword. It accepts a list of expressions, seperated by a ,.

Example:

case x {
    when "foo", "bar":
        return true
}
case {
    when x > 40:
        return true
}

»Else Clause

The else keyword allows for capturing any expressions that have no matching when clause.

Example:

case x {
    when "foo", "bar":
        return true
    else:
        return false
}
  • ProvisionMulti-Cloud Infrastructure
  • SecureMulti-Cloud Security
  • ConnectMulti-Cloud Networking
  • RunMulti-Cloud Orchestration
Products
  • Terraform
  • Vault
  • Consul
  • Nomad
  • Vagrant
  • Packer
  • Boundary NEW
  • Waypoint NEW
  • Sentinel
Resources
  • Blog
  • Tutorials
  • Community
  • Events
  • Integrations
  • Library
  • Partners
  • Podcast
  • Support
  • Training
Company
  • About Us
  • JobsWe're Hiring
  • Press Center
  • Brand
  • Contact Us
  • System Status
  • Cookie Manager
  • Terms of Use
  • Security
  • Privacy
  • Trademark Policy
stdin: is not a tty