data

Terraform data sources do not represent infrastructure directly managed by Terraform, so you will not directly write policies for them. However, in many Terraform configurations, data sources serve as the foundation for resource relationships, providing IDs or configurations fetched from existing infrastructure. You may need to mock these data sources in your policy tests to ensure that your policies correctly verify resources or modules that rely on this data.

Note

This functionality is in beta. Do not use beta features in production environments.

Configuration model

data "<data_source_type>" "<local_name>" {
  meta = {
    address = "<data_source_address>"
  }
  
  attrs = {
    <attribute_name> = <attribute_value>
  }
}

Complete configuration example

data "aws_vpc" "corporate_network" {
  attrs = {
    id         = "vpc-12345678"
    cidr_block = "10.0.0.0/16"
  }
}

data "aws_ami" "ubuntu" {
  attrs = {
    id               = "ami-12345678"
    name             = "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"
    architecture     = "x86_64"
    root_device_type = "ebs"
  }
}

Specification

Labels

Data blocks support two labels.

Label	Required	Description
First label	Yes	The data source type (For example: `aws_vpc`, `aws_ami`).
Second label	Yes	A unique name for this mock data source within the test file.

Arguments

Data blocks support the followng arguments.

Attribute	Required	Type	Description
`meta`	No	Object	Meta-attributes for the data source, including `address`.
`attrs`	Yes	Object	Data source attributes as returned by the provider.

The `meta` argument

You can set the following meta values in the meta argument.

Attribute	Type	Description
`address`	String	The full address of the data source in the Terraform configuration.

Behavior

Unlike resources, which might have a proposed state in a plan, data sources in Terraform are read-only. In your tests, data blocks serve as a static source of attributes that resource or module mocks can consume to match the behavior of the Terraform workspace you will enforce your policies on.

Examples

Mock VPC data source for subnet testing

data "aws_vpc" "main" {  
  attrs = {
    id         = "vpc-12345678"
    cidr_block = "10.0.0.0/16"
  }
}

resource "aws_subnet" "public" {
  attrs = {
    vpc_id            = data.aws_vpc.main.id
    cidr_block        = "10.0.1.0/24"
    availability_zone = "us-east-1a"
  }
}

Mock AMI data source for instance testing

data "aws_ami" "approved_ubuntu" {  
  attrs = {
    id           = "ami-12345678"
    name         = "ubuntu-22.04-approved"
    architecture = "x86_64"
  }
}

resource "aws_instance" "web" {
  attrs = {
    ami           = data.aws_ami.approved_ubuntu.id
    instance_type = "t3.micro"
  }
}

Mock availability zones for multi-AZ resources

data "aws_availability_zones" "available" {  
  attrs = {
    names = ["us-east-1a", "us-east-1b", "us-east-1c"]
    state = "available"
  }
}

resource "aws_subnet" "private" {
  attrs = {
    vpc_id            = "vpc-12345678"
    cidr_block        = "10.0.1.0/24"
    availability_zone = data.aws_availability_zones.available.names[0]
  }
}

Mock security group for instance testing

data "aws_security_group" "default" {  
  attrs = {
    id   = "sg-12345678"
    name = "default"
  }
}

resource "aws_instance" "app" {
  expect_failure = true
  
  attrs = {
    ami                    = "ami-12345678"
    instance_type          = "t3.micro"
    vpc_security_group_ids = [data.aws_security_group.default.id]
  }
}

Mock KMS key for encryption testing

data "aws_kms_key" "organization" {  
  attrs = {
    id     = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    key_id = "alias/organization-key"
  }
}

resource "aws_ebs_volume" "encrypted" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = true
    kms_key_id        = data.aws_kms_key.organization.id
  }
}

Mock IAM policy document

data "aws_iam_policy_document" "s3_read_only" {  
  attrs = {
    json = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Action = [
            "s3:GetObject",
            "s3:ListBucket"
          ]
          Resource = [
            "arn:aws:s3:::example-bucket",
            "arn:aws:s3:::example-bucket/*"
          ]
        }
      ]
    })
  }
}

resource "aws_iam_role_policy" "s3_access" {
  attrs = {
    name   = "s3-read-only"
    role   = "example-role"
    policy = data.aws_iam_policy_document.s3_read_only.json
  }
}

Multiple data sources for complex relationships

data "aws_vpc" "main" {  
  attrs = {
    id         = "vpc-12345678"
    cidr_block = "10.0.0.0/16"
  }
}

data "aws_subnet" "private" {  
  attrs = {
    id                = "subnet-12345678"
    vpc_id            = data.aws_vpc.main.id
    cidr_block        = "10.0.1.0/24"
    availability_zone = "us-east-1a"
  }
}

resource "aws_instance" "app" {
  attrs = {
    ami           = "ami-12345678"
    instance_type = "t3.micro"
    subnet_id     = data.aws_subnet.private.id
  }
}

Refer to Write and run policy tests to learn how to write and run tests
Refer to Test resource and data source relationships to learn about modeling dependencies