input

Terraform policy supports optional input blocks. These blocks behave like variable blocks within Terraform, allowing you to parameterize your policies.

Note

This functionality is in beta. Do not use beta features in production environments.

Configuration model

The input block supports the following configuration:

input "<label>" block | repeatable
- default any | optional
- description string | optional
- nullable boolean | optional
- sensitive boolean | optional
- type type constraint | required

Complete configuration example

The following example demonstrates an input block with all configuration options specified, a second input block, and a policy block that references inputs:

policies/example.policy.hcl

input "allowed_instance_types" {
  type        = list(string)
  description = "List of allowed EC2 instance types"
  default     = ["t3.micro", "t3.small"]
  sensitive   = false
  nullable    = false
}

input "environment" {
  type        = string
  description = "The environment name (For example: dev, staging, prod)"
  default     = "dev"
}

resource_policy "aws_instance" "instance_type_check" {
  enforce {
    condition     = core::contains(input.allowed_instance_types, attrs.instance_type)
    error_message = "Instance type ${attrs.instance_type} is not in the allowed list for the ${input.environment} environment: ${core::join(", ", input.allowed_instance_types)}"
  }
}

Specification

An input block supports the following configuration.

Label

The input block label gives a local name to the input variable. Must be unique within the policy file. Reference input variables with the syntax input.<label>.

`default`

The default attribute declares provides a default value for the input variable. If omitted and no value is provided by the policy configuration, the value is null, and Terraform policy errors unless nullable is set to true.

Data type: any
Default: None
Example: String input with default

`description`

A description of the input variable's purpose.

Data type: String
Default: None

`nullable`

Whether the input accepts a null value. If set to false, either the input block must provide a default value or the value must be set by the policy configuration, otherwise Terraform policy returns an error.

Data type: Boolean
Default: false

`sensitive`

Whether the input variable contains sensitive data.

Data type: Boolean
Default false

`type`

The type constraint for the input variable. Input variables support the same type constraints as Terraform.

Data type: Type constraint
Required

Referencing inputs

Reference input variables in your policies using the syntax input.<label>.

input "max_size" {
  type    = number
  default = 100
}

resource_policy "aws_instance" "size_check" {
  enforce {
    condition     = attrs.root_block_device[0].volume_size <= input.max_size
    error_message = "Root volume size must not exceed ${input.max_size} GB."
  }
}

Setting input values

When Terraform policy runs your policies, it will set values for inputs through the following methods, in order of precedence:

Policy set parameters in HCP Terraform
Environment variables with the prefix TFPOLICY_INPUT_ (For example, TFPOLICY_INPUT_environment)
Environment variables matching the input name exactly
The default value specified in the input block

If Terraform policy cannot assign a value to an input through one of the above methods and no default is specified, it will error.

Policy set parameters in HCP Terraform

When you configure your policy sets in HCP Terraform, you can set values for inputs with parameters. Refer to Policy Set Parameters for more information.

On the command line

When testing policies locally, set input values using environment variables:

$ export TFPOLICY_INPUT_environment=production
$ tfpolicy test --policies=/path/to/policies

Examples

The following examples demonstrate common input block configuration patterns for specific use cases.

String input with default value

In the following example, the input block defines a string variable with a default value and the resource policy references the input value.

input "environment" {
  type        = string
  description = "The deployment environment"
  default     = "dev"
}

resource_policy "aws_instance" "env_tag_check" {
  enforce {
    condition     = attrs.tags.environment == input.environment
    error_message = "Instance must be tagged with environment: ${input.environment}"
  }
}

List input for allowed values

In the following example, the input block defines a list of allowed AWS regions that the provider policy uses to validate the configured region.

input "allowed_regions" {
  type        = list(string)
  description = "List of allowed AWS regions"
  default     = ["us-east-1", "us-west-2"]
}

provider_policy "aws" "region_check" {
  enforce {
    condition     = core::contains(input.allowed_regions, attrs.region)
    error_message = "AWS provider region must be one of: ${core::join(", ", input.allowed_regions)}"
  }
}

Sensitive input

In the following example, the input block defines a sensitive API key that the resource policy uses to make authenticated HTTP requests for external validation.

input "api_key" {
  type        = string
  description = "API key for external validation service"
  sensitive   = true
}

resource_policy "aws_instance" "external_validation" {
  locals {
    validation_result = core::gethttprequest(
      "https://api.example.com/validate",
      {
        headers = {
          "Authorization" = "Bearer ${input.api_key}"
        }
      }
    )
  }

  enforce {
    condition     = local.validation_result.statusCode == 200
    error_message = "External validation failed."
  }
}

Complex object input

In the following example, the input block defines a complex object type with nested attributes that the resource policy uses to enforce tagging requirements.

input "tagging_requirements" {
  type = object({
    required_tags = list(string)
    environment   = string
  })
  description = "Tagging requirements for resources"
  default = {
    required_tags = ["owner", "project"]
    environment   = "dev"
  }
}

resource_policy "aws_instance" "tag_compliance" {
  locals {
    has_all_required_tags = core::alltrue([
      for tag in input.tagging_requirements.required_tags :
      core::contains(core::keys(attrs.tags), tag)
    ])
  }

  enforce {
    condition     = local.has_all_required_tags
    error_message = "Instance must have all required tags: ${core::join(", ", input.tagging_requirements.required_tags)}"
  }
}