The core::anytrue function

The core::anytrue function evaluates a list and returns true if any element evaluates to true. An empty list returns false. If any element is true, the function returns true. If no true elements are present but unknown elements exist, the function returns unknown. Values that are null are ignored. If any other element does not evaluate to a boolean, the function raises an error.

Note

This functionality is in beta. Do not use beta features in production environments.

Signature

core::anytrue(list)

Arguments

Argument	Required	Type	Description
`list`	Yes	List of booleans	The list of boolean values to evaluate.

Return value

Returns true if any element evaluates to true. An empty list returns false. If any element is true, the function returns true. If no true elements are present but unknown elements exist, the function returns unknown. Values that are null are ignored. If any other element does not evaluate to a boolean, the function raises an error.

Examples

The following examples demonstrate the use of core::anytrue for specific use cases.

Check if any security feature is enabled

In the following example, the core::anytrue function checks that at least one security feature is enabled.

resource_policy "aws_s3_bucket" "security_features" {
  locals {
    has_encryption    = attrs.server_side_encryption_configuration != null
    has_versioning    = attrs.versioning != null && attrs.versioning[0].enabled == true
    has_logging       = attrs.logging != null
    has_any_security  = core::anytrue([
      local.has_encryption,
      local.has_versioning,
      local.has_logging
    ])
  }

  enforce {
    condition     = local.has_any_security
    error_message = "S3 bucket must have at least one security feature enabled (encryption, versioning, or logging)"
  }
}

Validate at least one required tag exists

In the following example, the core::anytrue function validates that at least one of several acceptable tags is present.

resource_policy "aws_instance" "owner_tag" {
  locals {
    acceptable_owner_tags = ["Owner", "Team", "Department"]
    tag_checks = [
      for tag in local.acceptable_owner_tags :
      core::contains(core::keys(attrs.tags), tag)
    ]
    has_owner_tag = core::anytrue(local.tag_checks)
  }

  enforce {
    condition     = local.has_owner_tag
    error_message = "Instance must have at least one owner tag: ${core::join(", ", local.acceptable_owner_tags)}"
  }
}

Check for any public access

In the following example, the core::anytrue function detects if any ingress rule allows public access.

resource_policy "aws_security_group" "no_public_access" {
  locals {
    public_access_checks = [
      for rule in attrs.ingress :
      core::contains(rule.cidr_blocks, "0.0.0.0/0")
    ]
    has_public_access = core::anytrue(local.public_access_checks)
  }

  enforce {
    condition     = !local.has_public_access
    error_message = "Security group must not allow public access (0.0.0.0/0) on any ingress rule"
  }
}

Empty list behavior

In the following example, the core::anytrue function returns false for an empty list, which can be useful for ensuring resources have required configurations.

resource_policy "aws_instance" "must_have_volumes" {
  locals {
    volume_checks = [
      for vol in attrs.ebs_block_device :
      vol.encrypted == true
    ]
    has_encrypted_volumes = core::anytrue(local.volume_checks)
  }

  enforce {
    condition     = local.has_encrypted_volumes
    error_message = "Instance must have at least one encrypted EBS volume attached"
  }
}

Combine with alltrue for complex logic

In the following example, core::anytrue and core::alltrue work together to validate complex requirements.

resource_policy "aws_instance" "complex_validation" {
  locals {
    # At least one of these must be true
    has_monitoring = attrs.monitoring == true
    has_detailed_monitoring = attrs.detailed_monitoring == true
    any_monitoring = core::anytrue([local.has_monitoring, local.has_detailed_monitoring])
    
    # All of these must be true
    has_tags = attrs.tags != null
    has_iam_role = attrs.iam_instance_profile != null
    all_required = core::alltrue([local.has_tags, local.has_iam_role])
    
    # Final validation
    is_valid = local.any_monitoring && local.all_required
  }

  enforce {
    condition     = local.is_valid
    error_message = "Instance must have monitoring enabled, tags, and an IAM instance profile"
  }
}