input

You can set values for policy inputs either per test case, or for the entire test file with the input {} block. The input block is allowed within provider, resource, data, and module blocks, or as a top-level block. Inputs set on a specific block override inputs set at the top level of the test file.

Note

This functionality is in beta. Do not use beta features in production environments.

Configuration model

# Top-level inputs for entire test file
input {
  <input_name> = <input_value>
}

# Block-level inputs for specific test case
<block_type> "<label>" "<name>" {
  input {
    <input_name> = <input_value>
  }
}

Complete configuration example

# Top-level inputs apply to all test cases
input {
  require_encryption = true
  allowed_regions    = ["us-east-1", "us-west-2"]
}

resource "aws_ebs_volume" "encrypted" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = input.require_encryption
  }
}

resource "aws_ebs_volume" "unencrypted_allowed" {
  # Override top-level input for this specific test case
  input {
    require_encryption = false
  }
  
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = false
  }
}

Specification

Syntax

The input {} block contains one or more input assignments. Each assignment sets a value for a policy input variable.

Precedence

When Terraform policy runs your tests, it will set values for inputs in your policies through the following methods, in order of precedence:

In an input {} block inside a provider, resource, data, or module block (highest precedence)
In an input {} block at the top level of each test file
On the command line with --input option
From a TFPOLICY_INPUT_name environment variable matching the name of the input
From a variable definition file, with the --input-file option
From an environment variable with a name exactly matching the name of the input
The default value of the input configured in the policy file (lowest precedence)

Examples

Top-level inputs for all test cases

input {
  environment        = "production"
  require_encryption = true
}

resource "aws_ebs_volume" "prod_encrypted" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = input.require_encryption
    tags = {
      Environment = input.environment
    }
  }
}

resource "aws_instance" "prod_instance" {
  attrs = {
    instance_type = "t3.micro"
    ami           = "ami-12345678"
    tags = {
      Environment = input.environment
    }
  }
}

Override inputs per test case

input {
  max_volume_size = 100
}

resource "aws_ebs_volume" "within_limit" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 50
  }
}

resource "aws_ebs_volume" "custom_limit" {
  input {
    max_volume_size = 200
  }
  
  attrs = {
    availability_zone = "us-east-1a"
    size              = 150
  }
}

Complex input values

input {
  tagging_requirements = {
    required_tags = ["owner", "project", "environment"]
    environment   = "production"
  }
  
  allowed_instance_types = ["t3.micro", "t3.small", "t3.medium"]
}

resource "aws_instance" "compliant" {
  attrs = {
    instance_type = input.allowed_instance_types[0]
    ami           = "ami-12345678"
    tags = {
      owner       = "platform-team"
      project     = "web-app"
      environment = input.tagging_requirements.environment
    }
  }
}

Provider-specific inputs

input {
  aws_region = "us-east-1"
}

provider "aws" "correct_region" {
  input {
    aws_region = "us-east-1"
  }
  
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = input.aws_region
  }
}

provider "aws" "different_region" {
  input {
    aws_region = "us-west-2"
  }
  
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = input.aws_region
  }
}

Module-specific inputs

input {
  min_module_version = "2.0.0"
}

module "app.terraform.io/my-org/vpc/aws" "current" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = input.min_module_version
  }
  
  attrs = {
    name = "vpc"
    cidr = "10.0.0.0/16"
  }
}

module "app.terraform.io/my-org/vpc/aws" "newer" {
  input {
    min_module_version = "3.0.0"
  }
  
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = input.min_module_version
  }
  
  attrs = {
    name = "vpc"
    cidr = "10.0.0.0/16"
  }
}

Testing with different input combinations

input {
  encryption_enabled = true
  kms_key_required   = false
}

resource "aws_ebs_volume" "encrypted_no_kms" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = input.encryption_enabled
  }
}

resource "aws_ebs_volume" "encrypted_with_kms" {
  input {
    kms_key_required = true
  }
  
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = input.encryption_enabled
    kms_key_id        = "arn:aws:kms:us-east-1:123456789012:key/12345678"
  }
}

resource "aws_ebs_volume" "unencrypted" {
  input {
    encryption_enabled = false
  }
  
  expect_failure = true
  
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = false
  }
}

Write and run policy tests - Learn how to write and run tests
Set values for inputs - Learn about input precedence
The input {} block in policies - Policy input reference