provider_policy

The provider_policy block defines policies for Terraform providers. The first label of the block identifies the provider name, such as aws, google, or azurerm, and the second label is the policy name. You can use a wildcard (*) for the provider name to apply a single policy to every provider defined in the configuration.

Configuration model

The provider_policy block supports the following configuration:

• provider_policy   "<provider_name>"   "<policy_label>"   block | repeatable
  • enforce   block | repeatable
    • condition   boolean expression | required
    • error_message   string | optional
    • info_message   string | optional
  • enforcement_level   string | optional
  • filter   boolean expression | optional
  • locals   block | optional
    • <name>   any | repeatable

Complete configuration example

The following example demonstrates a provider_policy block with all configuration options specified:

provider_policy "aws" "standard_configuration" {
  enforcement_level = "mandatory"
  filter            = meta.alias == null

  locals {
    version_constraint = core::semverconstraint(meta.version, ">= 5.0.0")
  }

  enforce {
    condition     = attrs.region == "us-east-1"
    error_message = "All AWS resources must be deployed in the us-east-1 region."
    info_message  = "Checking provider region: ${attrs.region}"
  }

  enforce {
    condition     = meta.source == "hashicorp/aws"
    error_message = "Only the official HashiCorp AWS provider is permitted."
  }

  enforce {
    condition     = local.version_constraint
    error_message = "The AWS provider version must be at least 5.0.0."
  }
}

Specification

A provider_policy block supports the following configuration.

Provider name

Specifies the provider name, such as aws, google, azurerm. You can use the * wildcard to match all providers.

Policy label

Specifies a unique name for this policy within the policy file.

enforce

The enforce block defines a condition that must evaluate to true for the policy to pass. You can include one or more enforce blocks in each provider_policy block. If any of the enforce blocks' conditions fail during evaluation, then Terraform policy fails the policy and returns the corresponding error messages.

• Data type: Block
• Repeatable

An enforce block supports the following configuration.

condition

A boolean expression that must evaluate to true for the policy to pass.

• Data type: Boolean expression
• Required

error_message

The error message to display when the condition evaluates to false.

• Data type: String
• Default: None

info_message

An informational message to display regardless of whether the policy passes or fails.

• Data type: String
• Default: None

enforcement_level

Specifies the enforcement level for the policy. You can specify one of the following values:

• "advisory": Allows the operation to continue but prints a warning when if the conditions of the policy aren't met.

• "mandatory": Stops the operation if the conditions of the policy aren't met.

• "mandatory_overridable": Stops the operation if the conditions of the policy aren't met, but allows a user with appropriate permissions to override the policy and continue.

• Data type: String

• Default: "mandatory"

filter

Specifies a Boolean expression that filters which provider configurations the policy applies to based on their attributes. The left side of the expression references an attribute in the provider configuration. The right side specifies an attribute value. When the expression evaluates to true, the policy applies to the provider.

Use the attrs object in your expression to access arguments defined in the provider block, such as region settings or account identifiers. The attributes you can select with the attrs depend on the provider.

• Data type: Boolean expression
• Default: None

locals

Defines values that are local to the policy. You can only define one locals block per provider_policy block. The locals block nested in a provider_policy overrides locals blocks defined in the root of the policy file. Refer to the root-level locals block reference for more information.

• Data type: Block
• Default: None

Attributes

Within the provider_policy block, you have access to the following attributes.

Each Terraform provider defines the attributes available for its provider block. Refer to the provider documentation for a list of supported attributes.

meta object attributes

The following meta-arguments are available in provider_policy blocks.

Examples

The following examples demonstrate common provider policy configuration patterns for specific use cases.

Enforce provider source and version

In the following example, the provider_policy block validates that the AWS provider uses the official HashiCorp source and meets a minimum version requirement of 5.0.0.

provider_policy "aws" "approved_provider" {
  enforcement_level = "mandatory"

  enforce {
    condition     = meta.source == "hashicorp/aws"
    error_message = "Only the official HashiCorp AWS provider is permitted."
  }

  enforce {
    condition     = core::semverconstraint(meta.version, ">= 5.0.0")
    error_message = "The AWS provider version must be at least 5.0.0."
  }
}

Enforce provider configuration

In the following example, the provider_policy block enforces that the AWS provider is configured to use the us-east-1 region.

provider_policy "aws" "region_check" {
  enforce {
    condition     = attrs.region == "us-east-1"
    error_message = "All AWS resources must be deployed in the us-east-1 region."
  }
}

Use wildcard to match all providers

In the following example, the provider_policy block uses a wildcard to enforce that only official HashiCorp providers are allowed across all provider types.

provider_policy "*" "require_official_providers" {
  enforcement_level = "mandatory"

  enforce {
    condition     = core::contains(["hashicorp", "terraform-providers"], core::split("/", meta.source)[0])
    error_message = "Only official HashiCorp providers are allowed. Provider ${meta.source} is not permitted."
  }
}

Filter by provider alias

In the following example, the provider_policy block uses a filter to target only the secondary AWS provider configuration and enforce a specific region requirement.

provider_policy "aws" "secondary_region_check" {
  filter = meta.alias == "secondary"

  enforce {
    condition     = attrs.region == "us-west-2"
    error_message = "The secondary AWS provider must use the us-west-2 region."
  }
}