The core::getdatasource function

The core::getdatasource function returns a data source of the specified type that matches the given configuration. Terraform policy passes the data source configuration to the provider, and returns a matching data source object. Since this function returns a single data source, you must include configuration as needed to specify a single data source. Refer to the provider documentation for the specified data source type to learn more.

Note

This functionality is in beta. Do not use beta features in production environments.

Signature

core::getdatasource(data_source_type, config)

Arguments

Argument	Required	Type	Description
`data_source_type`	Yes	String	The type of data source to retrieve (For example: `"aws_lambda_function"`, `"aws_ami"`).
`config`	Yes	Object	An object representing the data source configuration. Terraform policy validates the object against the data source schema and uses ???? to fetch the data source from the provider.

Return value

Returns a single data source object that matches the specified type and configuration. The object contains the data source's attributes as returned by the provider, including computed attributes.

Nested block arguments

Data source arguments use various types, including nested block arguments. For most argument types, you will assign a value of the matching type within the config object. However, when a data source uses nested blocks in Terraform configuration, you must represent them differently in Terraform policy.

The type of each argument, including nested blocks, is defined by the provider's schema. There are three types of nested blocks:

Terraform block type	Terraform policy config value
Single nested	Object
List nested	List of objects
Set nested	List of objects

For example, the AWS aws_ami data source uses a set nested block for filter. In Terraform configuration, you would write:

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

In Terraform policy, represent the filter blocks as a list of objects:

locals {
  ami = core::getdatasource("aws_ami", {
    most_recent = true
    owners      = ["amazon"]
    filter      = [
      {
        name   = "name"
        values = ["amzn2-ami-hvm-*"]
      },
      {
        name   = "virtualization-type"
        values = ["hvm"]
      }
    ]
  })
}

Examples

The following examples demonstrate the use of data sources for specific use cases.

Retrieve a Lambda function by name

In the following example, the core::getdatasource function retrieves an AWS Lambda function with the given name.

locals {
  function = core::getdatasource("aws_lambda_function", {
    function_name = "example-function"
  })
}

resource_policy "aws_lambda_permission" "function_exists" {
  enforce {
    condition     = local.function != null
    error_message = "Lambda function 'example-function' must exist before creating permissions."
  }
}

Retrieve an AMI by filter

In the following example, the core::getdatasource function retrieves an AWS AMI that matches the filter and validates the AMI ID.

locals {
  amazon_linux_ami = core::getdatasource("aws_ami", {
    most_recent = true
    owners      = ["amazon"]
    filter      = [
      {
        name   = "name"
        values = ["amzn2-ami-hvm-*-x86_64-gp2"]
      },
      {
        name   = "virtualization-type"
        values = ["hvm"]
      }
    ]
  })
}

resource_policy "aws_instance" "approved_ami" {
  enforce {
    condition     = attrs.ami == local.amazon_linux_ami.id
    error_message = "Instance must use the approved Amazon Linux 2 AMI: ${local.amazon_linux_ami.id}"
  }
}

Use with conditional logic

In the following example, the core::getdatasource function retrieves an AWS KMS key that matches the filter, if any.

locals {
  # Try to retrieve a KMS key
  kms_key = core::try(
    core::getdatasource("aws_kms_key", {
      key_id = "alias/my-key"
    }),
    null
  )
  has_kms_key = local.kms_key != null
}

resource_policy "aws_ebs_volume" "encryption_check" {
  enforce {
    condition     = attrs.encrypted == true
    error_message = "EBS volumes must be encrypted."
  }

  enforce {
    condition     = !local.has_kms_key || attrs.kms_key_id == local.kms_key.id
    error_message = "EBS volumes must use the organization's KMS key when available."
  }
}