The core::valuetostring function

The core::valuetostring function converts any value to a string representation.

This function differs from Terraform's tostring() function, which only handles primitive types. The core::valuetostring function can convert any value type to a string. Primitive types (string, number, bool) are rendered directly, while complex types (objects, lists, maps, sets, tuples) are encoded as indented JSON. Unknown values render as (unknown) and null values as (null).

Note

This functionality is in beta. Do not use beta features in production environments.

Signature

core::valuetostring(value)

Arguments

Argument	Required	Type	Description
`value`	Yes	Any	The value to convert to a string. Can be any type including null and unknown values.

Return value

Returns a string representation of the value:

Primitive types (string, number, bool) are rendered directly
Complex types (objects, lists, maps, sets, tuples) are encoded as indented JSON
Unknown values render as (unknown)
Null values render as (null)

Examples

The following examples demonstrate the use of value-to-string conversion for specific use cases.

Convert primitive values

In the following example, the core::valuetostring function converts various primitive types to strings.

resource_policy "aws_instance" "log_attributes" {
  locals {
    instance_type_str = core::valuetostring(attrs.instance_type)
    monitoring_str    = core::valuetostring(attrs.monitoring)
    cpu_credits_str   = core::valuetostring(attrs.credit_specification.cpu_credits)
  }

  enforce {
    condition    = true
    info_message = "Instance type: ${local.instance_type_str}, Monitoring: ${local.monitoring_str}, CPU credits: ${local.cpu_credits_str}"
  }
}

Convert complex objects to JSON

In the following example, the core::valuetostring function converts an object to a formatted JSON string to use in an enforcement message.

resource_policy "aws_s3_bucket" "log_tags" {
  locals {
    tags_json = core::valuetostring(attrs.tags)
  }

  enforce {
    condition    = true
    info_message = "Bucket tags:\n${local.tags_json}"
  }
}

Handle unknown values

In the following example, the core::valuetostring function safely handles unknown values during policy evaluation.

resource_policy "aws_instance" "handle_unknown" {
  locals {
    # If private_ip is unknown (computed), this will return "(unknown)"
    private_ip_str = core::valuetostring(attrs.private_ip)
  }

  enforce {
    condition    = true
    info_message = "Instance private IP: ${local.private_ip_str}"
  }
}

Convert lists and maps

In the following example, the core::valuetostring function converts collection types to formatted JSON.

resource_policy "aws_security_group" "log_rules" {
  locals {
    ingress_rules = core::valuetostring(attrs.ingress)
    egress_rules  = core::valuetostring(attrs.egress)
  }

  enforce {
    condition    = true
    info_message = "Ingress rules:\n${local.ingress_rules}\n\nEgress rules:\n${local.egress_rules}"
  }
}

Debug complex nested structures

In the following example, the core::valuetostring function helps debug complex nested resource configurations.

resource_policy "aws_lambda_function" "debug_config" {
  locals {
    environment_config = core::valuetostring(attrs.environment)
    vpc_config         = core::valuetostring(attrs.vpc_config)
  }

  enforce {
    condition    = true
    info_message = "Lambda environment:\n${local.environment_config}\n\nVPC config:\n${local.vpc_config}"
  }
}

Create audit messages

In the following example, the core::valuetostring function creates detailed audit messages with full resource configuration.

resource_policy "aws_iam_role" "audit_policy" {
  locals {
    assume_role_policy = core::valuetostring(attrs.assume_role_policy)
    inline_policies    = core::valuetostring(attrs.inline_policy)
  }

  enforce {
    condition    = true
    info_message = "IAM Role ${attrs.name} created with:\nAssume role policy:\n${local.assume_role_policy}\n\nInline policies:\n${local.inline_policies}"
  }
}