The core::alltrue function

The core::alltrue function evaluates a list and returns true if all elements evaluate to true, or if the list is empty. If any element evaluates to false, the function returns false. Values that are null evaluate to false. If any other element does not evaluate to a boolean value, the function returns an error.

Note

This functionality is in beta. Do not use beta features in production environments.

Signature

core::alltrue(list)

Arguments

Argument	Required	Type	Description
`list`	Yes	List of booleans	The list of booleans to evaluate.

Return value

Returns true if all elements evaluate to true, or if the list is empty. If any element evaluates to false, the function returns false. Values that are null evaluate to false. If any other element does not evaluate to a boolean value, the function returns an error.

Examples

The following examples demonstrate the use of core::alltrue for specific use cases.

Validate multiple conditions

In the following example, the core::alltrue function checks that multiple security requirements are met.

resource_policy "aws_s3_bucket" "security_requirements" {
  locals {
    has_encryption    = attrs.server_side_encryption_configuration != null
    has_versioning    = attrs.versioning[0].enabled == true
    has_logging       = attrs.logging != null
    all_requirements  = core::alltrue([
      local.has_encryption,
      local.has_versioning,
      local.has_logging
    ])
  }

  enforce {
    condition     = local.all_requirements
    error_message = "S3 bucket must have encryption, versioning, and logging enabled"
  }
}

Check all tags are present

In the following example, the core::alltrue function validates that all required tags exist on a resource.

resource_policy "aws_instance" "required_tags" {
  locals {
    required_tags = ["Environment", "Owner", "Project", "CostCenter"]
    tag_checks    = [
      for tag in local.required_tags :
      core::contains(core::keys(attrs.tags), tag)
    ]
    all_tags_present = core::alltrue(local.tag_checks)
  }

  enforce {
    condition     = local.all_tags_present
    error_message = "Instance must have all required tags: ${core::join(", ", local.required_tags)}"
  }
}

Validate security group rules

In the following example, the core::alltrue function ensures all ingress rules meet security requirements.

resource_policy "aws_security_group" "ingress_validation" {
  locals {
    ingress_checks = [
      for rule in attrs.ingress :
      rule.cidr_blocks[0] != "0.0.0.0/0" || rule.from_port == 443
    ]
    all_rules_valid = core::alltrue(local.ingress_checks)
  }

  enforce {
    condition     = local.all_rules_valid
    error_message = "Security group ingress rules must not allow unrestricted access except for HTTPS (port 443)"
  }
}