policy

The policy block configures how Terraform policy evaluates your policies, including which version of Terraform to use to perform the evaluation.

Configuration model

The policy block supports the following configuration:

• policy   block
  • plugins   block
    • <plugin_label>   map
      • source   string | required
  • terraform_config   block
    • required_version   string

Complete configuration example

The following example demonstrates a policy block with all configuration options specified:

policy {
  terraform_config {
    required_version = ">= 1.16.0"
  }
  plugins {
    example = {
      source = "../plugins/bin/example"
    }
    custom_validator = {
      source = "../plugins/bin/custom-validator"
    }
  }
}

Specification

A policy block supports the following configuration.

plugins

Specifies plugins that provide custom functions to use in your policies. Plugins must be compiled binaries. Refer to Policy plugins for more information.

Specify each plugin as a map within the plugins block.

• Data type: Block
• Default: None
• Example: Configure multiple plugins

A plugins block supports the following configuration.

Plugin map label

The plugin block label gives a name to the plugin. Must be unique within the policy file.

Plugin map key source

The source attribute is the path to the plugin binary. The binary must be a valid Terraform policy Go plugin server. Refer to Policy plugins for more information about creating and using policy plugins.

• Data type: String
• Required

In your policies, reference your functions with the syntax plugin::<plugin_label>::<function_name>(<function_arguments>...).

terraform_config

The terraform_config block defines settings specific to the Terraform CLI provisioning the infrastructure. The terraform_config block takes the required_version as an argument.

• Data type: Block
• Default: None

required_version

A version constraint specifying which versions of Terraform the policy is compatible with.

• Data type: String

Examples

The following examples demonstrate common policy block configuration patterns for specific use cases.

Require minimum Terraform version

In the following example, the policy block sets a minimum Terraform version requirement of 1.16.0 or higher.

policy {
  terraform_config {
    required_version = ">= 1.16.0"
  }
}

Configure multiple plugins

In the following example, the policy block configures two custom plugins that provide additional functions for use in policy evaluation.

policy {
  plugins {
    example = {
      source = "../plugins/bin/example"
    }
    validator = {
      source = "../plugins/bin/validator"
    }
  }
}