provider

To test a provider policy, add a mock provider block to your test file. Use the meta argument to set meta-attributes, including the provider source and version. Use the attrs argument to set values for any attributes defined by the provider itself.

Configuration model

The provider block supports the following configuration:

• provider   "<provider_name>"   "<test_label>"   block
  • attrs   object | optional
    • <attribute_name>   any | repeatable
  • expect_failure   boolean | optional
  • inputs   block | optional
    • <input_name>   any | repeatable
  • meta   object | optional
    • alias   string
    • name   string
    • namespace   string
    • source   string
    • type   string
    • version   string

Complete configuration example

The following example demonstrates a provider block with all configuration options specified:

provider "aws" "all_options" {
  expect_failure = true
  
  meta = {
    type      = "aws"
    name      = "aws"
    source    = "hashicorp/aws"
    version   = "4.0.0"
    alias     = "secondary"
    namespace = "hashicorp"
  }
  
  attrs = {
    region = "us-east-1"
  }

  inputs {
    min_version = "5.0.0"
  }
}

Specification

A provider block supports the following configuration.

Provider name

The provider name, such as aws, google, and azurerm.

Test label

A unique name for this test case within the test file.

attrs

Provider configuration attributes as defined by the provider schema. Each provider defines the value attributes. Refer to the provider documentation for more information.

• Data type: Object
• Default: None

expect_failure

Set to true to expect this mock to fail the matching policies.

• Data type: Boolean
• Default: false

inputs

Set policy input values specific to this test case.

• Data type: Block
• Default: None

meta

Meta-attributes for the provider, including source, version, and alias.

• Data type: Object
• Default: None

You can set the following meta values in the meta argument.

Examples

The following examples demonstrate common mock provider configuration patterns for specific use cases.

Test provider source and version

In the following example, mock provider blocks test a policy that validates provider source and version. The first block mocks the passing scenario and the second mocks the failing scenario.

provider "aws" "approved_provider" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = "us-east-1"
  }
}

provider "aws" "unapproved_source" {
  expect_failure = true
  
  meta = {
    source  = "custom/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = "us-east-1"
  }
}

Test provider configuration

In the following example, mock provider blocks test a policy that enforces a specific AWS region. The first block mocks the correct region and the second block mocks an incorrect region.

provider "aws" "correct_region" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = "us-east-1"
  }
}

provider "aws" "wrong_region" {
  expect_failure = true
  
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = "eu-west-1"
  }
}

Test aliased providers

In the following example, mock provider blocks test policies for aliased AWS providers configured for different regions.

provider "aws" "primary_region" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
    alias   = "primary"
  }
  
  attrs = {
    region = "us-east-1"
  }
}

provider "aws" "secondary_region" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
    alias   = "secondary"
  }
  
  attrs = {
    region = "us-west-2"
  }
}

Test with input variables

In the following example, mock provider blocks test a policy that uses input variables, with one test case overriding the input value.

The policy file under test declares the input:

input "allowed_region" {
  type    = string
  default = "us-east-1"
}

The policy test file can override the input for an individual provider test case:

provider "aws" "configurable_region" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = input.allowed_region
  }
}

provider "aws" "override_region" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = "us-west-2"
  }
  
  inputs {
    allowed_region = "us-west-2"
  }
}

Test multiple provider configurations

In the following example, mock provider blocks test policies across AWS and Google cloud providers with different configurations.

provider "aws" "pass_all_checks" {
  meta = {
    source  = "hashicorp/aws"
    version = "5.0.0"
  }
  
  attrs = {
    region = "us-east-1"
    default_tags = {
      tags = {
        Environment = "production"
        ManagedBy   = "terraform"
      }
    }
  }
}

provider "google" "approved_config" {
  meta = {
    source  = "hashicorp/google"
    version = "5.0.0"
  }
  
  attrs = {
    project = "my-project"
    region  = "us-central1"
  }
}