The core::getdatasource function

The core::getdatasource function returns a data source of the specified type that matches the given configuration. Terraform policy passes the data source configuration to the provider, and returns a matching data source object. Since this function returns a single data source, you must include configuration as needed to specify a single data source. Refer to the provider documentation for the specified data source type to learn more.

Signature

core::getdatasource(data_source_type, config)

Arguments

Return value

Returns a single data source object that matches the specified type and configuration. The object contains the data source's attributes as returned by the provider, including computed attributes.

Nested block arguments

Data source arguments in Terraform configuration can contain one or more nested blocks of arguments. When creating Terraform policy code against data source arguments, you must represent the nested blocks according to the provider's schema.

In Terraform configuration, you can nest a single block, a list of blocks, or a set of blocks. Each block can contain its own arguments. Assign Terraform policy arguments according to the nested block's data type: |------------|-------------------------------| | Single nested | Assign an object value to an attribute with the same name as the block. | | List nested | Assign a list of object values. | | Set nested | Assign a list of object values. |

For example, the AWS aws_ami data source lets you define a set of nested blocks to filter responses. In Terraform configuration, you could write the following filter blocks to filter AMIs by name and virtualization type:

data "aws_ami" "example" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

In Terraform policy, represent the filter blocks as a list of objects:

locals {
  ami = core::getdatasource("aws_ami", {
    most_recent = true
    owners      = ["amazon"]
    filter      = [
      {
        name   = "name"
        values = ["amzn2-ami-hvm-*"]
      },
      {
        name   = "virtualization-type"
        values = ["hvm"]
      }
    ]
  })
}

Examples

The following examples demonstrate the use of data sources for specific use cases.

Retrieve a Lambda function by name

In the following example, the core::getdatasource function retrieves an AWS Lambda function with the given name.

locals {
  function = core::getdatasource("aws_lambda_function", {
    function_name = "example-function"
  })
}

resource_policy "aws_lambda_permission" "function_exists" {
  enforce {
    condition     = local.function != null
    error_message = "Lambda function 'example-function' must exist before creating permissions."
  }
}

Retrieve an AMI by filter

In the following example, the core::getdatasource function retrieves an AWS AMI that matches the filter and validates both the AMI ID and name pattern.

locals {
  amazon_linux_ami = core::getdatasource("aws_ami", {
    most_recent = true
    owners      = ["amazon"]
    filter      = [
      {
        name   = "name"
        values = ["amzn2-ami-hvm-*-x86_64-gp2"]
      },
      {
        name   = "virtualization-type"
        values = ["hvm"]
      }
    ]
  })
}

resource_policy "aws_instance" "approved_ami" {
  enforce {
    condition     = attrs.ami == local.amazon_linux_ami.id
    error_message = "Instance must use the approved Amazon Linux 2 AMI: ${local.amazon_linux_ami.id}"
  }
}

Use with conditional logic

In the following example, the core::getdatasource function retrieves an AWS KMS key that matches the filter, if any.

locals {
  # Try to retrieve a KMS key
  kms_key = core::try(
    core::getdatasource("aws_kms_key", {
      key_id = "alias/my-key"
    }),
    null
  )
  has_kms_key = local.kms_key != null
}

resource_policy "aws_ebs_volume" "encryption_check" {
  enforce {
    condition     = attrs.encrypted == true
    error_message = "EBS volumes must be encrypted."
  }

  enforce {
    condition     = !local.has_kms_key || attrs.kms_key_id == local.kms_key.id
    error_message = "EBS volumes must use the organization's KMS key when available."
  }
}