Write policies

Terraform policy's configuration language is based on HCL. You will write configuration blocks to configure Terraform policy, define input variables and locals, and write policies for Terraform providers, resources, and modules.

Note

This functionality is in beta. Do not use beta features in production environments.

Policy syntax

Terraform policy uses an HCL-based configuration language to define policies that validate Terraform runs. The language provides blocks for configuring Terraform policy itself and for writing policies that validate providers, resources, and modules.

Policy files

Create a file policy.hcl file to store related policies. This file includes configuration for Terraform policy itself. It also contains one or more policy definitions. Each policy definition can target a specific Terraform construct.

Configure Terraform policy

The policy block configures Terraform policy itself. Refer to policy for more information.

Policies

Terraform policy's configuration language defines blocks to allow you to write policies for Terraform providers, resources, and modules:

To write policies for Terraform providers, refer to The provider_policy {} block.
To write policies for Terraform resources, refer to The resource_policy {} block.
To write policies for Terraform modules, refer to The module_policy {} block.

Arguments and blocks

Like Terraform configuration, policy blocks contain arguments and blocks that allow you to configure the policy. Each policy block type supports various arguments and blocks. Refer to the individual policy block reference pages for a list of supported arguments and blocks.

Terraform attributes

You can reference attribute and meta-argument values from Terraform runs in your policies. Use the attr prefix to refer to provider, resource, or module attributes, and meta to refer to Terraform meta-arguments such as provider and module source and versions. Refer to the individual policy block reference pages for a list of supported meta-arguments.

Operators

Terraform policy supports most Terraform operators for building conditions and expressions. Refer to Operators for more information.

Functions

Terraform policy includes built-in functions to fetch resources and data sources, as well as most Terraform library functions. Refer to Functions for more information.

Input variables and locals

Terraform policy supports input variables and local values to allow you to parameterize your policy configuration:

Refer to Input variables to learn how to parameterize your policies with inputs.
Refer to Local values to learn how to use local values.

Plugins

You can write custom Terraform policy functions as plugins in Golang. Refer to Policy plugins for more information.

Next steps

Review the policy reference documentation for detailed information about each policy block type.
Learn how to test your policies.
View example policies.