The core::regex_match function

The core::regex_match function matches a string against a regular expression pattern. It returns true if the string matches the pattern, and false otherwise.

Note

This functionality is in beta. Do not use beta features in production environments.

Signature

core::regex_match(str, pattern)

Arguments

Argument	Required	Type	Description
`str`	Yes	String	The string to match against the pattern.
`pattern`	Yes	String	The regular expression pattern.

Return value

Returns true if the string matches the regular expression pattern, false otherwise. Returns an error if the pattern is invalid.

Pattern syntax

The pattern uses Go's regular expression syntax. Refer to the Go regexp documentation for detailed syntax information.

Common pattern elements:

Pattern	Description
`.`	Matches any character
`^`	Matches the start of the string
`$`	Matches the end of the string
`*`	Matches zero or more of the preceding element
`+`	Matches one or more of the preceding element
`?`	Matches zero or one of the preceding element
`[abc]`	Matches any character in the set
`[^abc]`	Matches any character not in the set
`\d`	Matches any digit character
`\w`	Matches any word character
`\s`	Matches any whitespace character

The \ character in Terraform policy strings must be escaped with an additional \. For example, \\d in a Terraform policy string will match a digit character.

Examples

The following examples demonstrate the use of regex matching for specific use cases.

Validate resource naming convention

In the following example, the core::regex_match function validates that S3 bucket names follow a specific pattern.

resource_policy "aws_s3_bucket" "naming_convention" {
  locals {
    # Pattern: environment-application-purpose-randomid
    # Example: prod-webapp-logs-a1b2c3
    valid_pattern   = "^(dev|staging|prod)-[a-z]+-[a-z]+-[a-z0-9]{6}$"
    matches_pattern = core::regex_match(attrs.bucket, local.valid_pattern)
  }

  enforce {
    condition     = local.matches_pattern
    error_message = "Bucket name must match pattern: ${local.valid_pattern}. Current: ${attrs.bucket}"
  }
}

Validate version strings

In the following example, the core::regex_match function ensures version tags follow semantic versioning.

resource_policy "aws_lambda_function" "semantic_version" {
  locals {
    # Semantic version pattern: major.minor.patch
    semver_pattern    = "^\\d+\\.\\d+\\.\\d+$"
    has_valid_version = core::regex_match(attrs.tags.version, local.semver_pattern)
  }

  enforce {
    condition     = local.has_valid_version
    error_message = "Version tag must follow semantic versioning (e.g., 1.2.3). Current: ${attrs.tags.version}"
  }
}

Check for prohibited patterns

In the following example, the core::regex_match function ensures resource names don't contain prohibited patterns.

resource_policy "aws_iam_role" "no_test_pattern" {
  locals {
    prohibited_pattern = "(?i)(test|temp)"
    has_prohibited     = core::regex_match(attrs.name, local.prohibited_pattern)
  }

  enforce {
    condition     = !local.has_prohibited
    error_message = "IAM role name cannot contain 'test' or 'temp'. Current: ${attrs.name}"
  }
}