module_policy

The module_policy block defines policies for your workspaces' Terraform modules. Module policies allow you to set guardrails at the abstraction layer where infrastructure is often packaged and shared. The first label of the block specifies the module source. The second label is a unique name for the policy itself. You can use a wildcard (*) for the module source to apply the policy to every module in the workspace.

Terraform modules define configuration for one or more resources. Use resource policies to target resources within modules.

Configuration model

The module_policy block supports the following configuration:

• module_policy   "<module_source>"   "<policy_label>"   block | repeatable
  • enforce   block | repeatable
    • condition   boolean expression | required
    • error_message   string | optional
    • info_message   string | optional
  • enforcement_level   string | optional
  • filter   boolean expression | optional
  • locals   block | optional
    • <name>   any | repeatable

Complete configuration example

The following example demonstrates a module_policy block that matches all modules with all configuration options specified and a module_policy block that matches a specified module:

module_policy "*" "version_and_source_check" {
  enforcement_level = "mandatory"
  filter            = meta.version != null

  locals {
    min_version = "1.0.0"
  }

  enforce {
    condition     = core::semverconstraint(meta.version, ">= ${local.min_version}")
    error_message = "Module version must be at least ${local.min_version}."
  }
}

module_policy "git::github.com/org/terraform-aws-vpc" "specific_version_check" {
  enforcement_level = "mandatory"

  enforce {
    condition     = core::semverconstraint(meta.version, ">= 2.0.0")
    error_message = "The official VPC module must be at version 2.0.0 or higher."
  }
}

Specification

A module_policy block supports the following configuration.

Module source

Specifies where Terraform policy retrieves the module source code. Refer to the Terraform module block reference for valid module sources.

Use * to match all modules.

Policy label

A unique local name for this policy within the policy file.

enforce

The enforce block defines a condition that must evaluate to true for the policy to pass. You can include one or more enforce blocks in each module_policy block. If any of the enforce blocks' conditions fail during evaluation, then Terraform policy fails the policy and returns the corresponding error messages.

• Data type: Block
• Repeatable

An enforce block supports the following configuration.

condition

A boolean expression that must evaluate to true for the policy to pass.

• Data type: Boolean expression
• Required

error_message

The error message to display when the condition evaluates to false.

• Data type: String
• Default: None

info_message

An informational message to display regardless of whether the policy passes or fails.

• Data type: String
• Default: None

enforcement_level

Specifies the enforcement level for the policy. You can specify one of the following values:

• "advisory": Allows the operation to continue but prints a warning when if the conditions of the policy aren't met.

• "mandatory": Stops the operation if the conditions of the policy aren't met.

• "mandatory_overridable": Stops the operation if the conditions of the policy aren't met, but allows a user with appropriate permissions to override the policy and continue.

• Data type: String

• Default: "mandatory"

filter

Specifies a Boolean expression that filters which modules the policy applies to based on their attributes.

• Data type: Boolean expression
• Default: None

locals

Defines values that are local to the policy. You can only define one locals block per module_policy block. The locals block nested in a module_policy overrides locals blocks defined in the root of the policy file. Refer to the root-level locals block reference for more information.

• Data type: Block
• Default: None

Attributes

Within the module_policy block, you have access to the following attributes.

meta object attributes

Module policies support the following meta attributes.

Examples

The following examples demonstrate common module policy configuration patterns for specific use cases.

Enforce approved module sources

In the following example, the module_policy block uses a wildcard to enforce that only modules from an approved list of sources can be used.

locals {
  approved_sources = [
    "./modules/networking",
    "git::github.com/org/terraform-aws-vpc",
    "git::github.com/org/terraform-aws-security"
  ]
}

module_policy "*" "approved_sources_only" {
  enforcement_level = "mandatory"

  enforce {
    condition     = core::contains(local.approved_sources, meta.source)
    error_message = "Module source ${meta.source} is not in the approved list. Only approved modules may be used."
  }
}

Enforce minimum module version

In the following example, the module_policy block enforces that a specific VPC module must be at version 2.0.0 or higher.

module_policy "git::github.com/org/terraform-aws-vpc" "minimum_version" {
  enforcement_level = "mandatory"

  enforce {
    condition     = core::semverconstraint(meta.version, ">= 2.0.0")
    error_message = "The VPC module must be at version 2.0.0 or higher."
  }
}

Enforce source and version checks

In the following example, the module_policy block combines both source validation and version requirements to ensure modules meet organizational standards.

locals {
  approved_sources = [
    "./modules/networking",
    "git::github.com/org/terraform-aws-vpc"
  ]
}

module_policy "*" "comprehensive_check" {
  enforcement_level = "mandatory"

  enforce {
    condition     = core::contains(local.approved_sources, meta.source)
    error_message = "The module source ${meta.source} is not in the approved list."
  }
  
  enforce {
    condition     = core::semverconstraint(meta.version, ">= 1.0.0")
    error_message = "Module version must be at least 1.0.0."
    info_message  = "Current module version: ${meta.version}"
  }
}