inputs

You can set values for policy inputs either per test case, or for the entire test file with the inputs block. The inputs block is allowed within provider, resource, and module blocks, or as a top-level block within policy test files. Inputs set on a specific block override inputs set at the top level of the test file.

Configuration model

The inputs block supports the following configuration:

• inputs   block
  • <input_name>   any | repeatable

Complete configuration example

The following example demonstrates an inputs block that sets values for two inputs:

inputs {
  require_encryption = true
  allowed_regions    = ["us-east-1", "us-west-2"]
}

Specification

An inputs block supports the following configuration.

Input name

Sets a value for an input block declared in the policies to be tested.

• Data type: Any
• Default: None

Precedence

When Terraform policy runs your tests, it will set values for inputs in your policies through the following methods, in order of precedence:

1. In an inputs block inside a provider, resource, data, or module block.
2. In an inputs block at the top level of each test file.
3. On the command line, set with the --input option.
4. From a TFPOLICY_INPUT_name environment variable matching the name of the input.
5. From a variable definition file, with the --input-file option.
6. The default value of the input configured in the policy file.

Examples

The following examples demonstrate common inputs block configuration patterns for specific use cases.

Top-level inputs

In the following example, the top-level inputs block sets default values that apply to all test cases in the file.

inputs {
  environment        = "production"
  require_encryption = true
}

resource "aws_ebs_volume" "prod_encrypted" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 10
    encrypted         = input.require_encryption
    tags = {
      Environment = input.environment
    }
  }
}

resource "aws_instance" "prod_instance" {
  attrs = {
    instance_type = "t3.micro"
    ami           = "ami-12345678"
    tags = {
      Environment = input.environment
    }
  }
}

Override inputs per test case

In the following example, the top-level inputs block sets a default value, while individual test cases override it with their own inputs blocks.

inputs {
  max_volume_size = 100
}

resource "aws_ebs_volume" "within_limit" {
  attrs = {
    availability_zone = "us-east-1a"
    size              = 50
  }
}

resource "aws_ebs_volume" "custom_limit" {
  inputs {
    max_volume_size = 200
  }
  
  attrs = {
    availability_zone = "us-east-1a"
    size              = 150
  }
}

Complex input values

In the following example, the inputs block defines complex data structures including objects and lists that test cases reference in their configurations.

inputs {
  tagging_requirements = {
    required_tags = ["owner", "project", "environment"]
    environment   = "production"
  }
  
  allowed_instance_types = ["t3.micro", "t3.small", "t3.medium"]
}

resource "aws_instance" "compliant" {
  attrs = {
    instance_type = input.allowed_instance_types[0]
    ami           = "ami-12345678"
    tags = {
      owner       = "platform-team"
      project     = "web-app"
      environment = input.tagging_requirements.environment
    }
  }
}