Write policies

Terraform policy's configuration language is based on HCL. You will write configuration blocks to configure Terraform policy, define input variables and locals, and write policies for Terraform providers, resources, and modules.

Policy syntax

Terraform policy uses an HCL-based configuration language to define policies that validate Terraform runs. The language provides blocks for configuring Terraform policy itself and for writing policies that validate providers, resources, and modules.

Policy files

Create a .policy.hcl file to store related policies. This file contains configuration for the policy and one or more policy definitions. Each policy definition can target a specific Terraform construct.

Configure Terraform policy

The policy block configures Terraform policy itself. Refer to policy for more information.

Policies

Terraform policy's configuration language defines blocks to allow you to write policies for Terraform providers, resources, and modules:

• To write policies for Terraform providers, refer to provider_policy.
• To write policies for Terraform resources, refer to resource_policy.
• To write policies for Terraform modules, refer to module_policy.

Arguments and blocks

Like Terraform configuration, policy blocks contain arguments and blocks that allow you to configure the policy. Each policy block type supports various arguments and blocks. Refer to the individual policy block reference pages for a list of supported arguments and blocks.

Terraform attributes

You can reference attribute and meta-argument values from Terraform runs in your policies. Reference provider or resource attributes with the attr. prefix. When you write policies for resource update operations, reference the prior state of resource attributes with the prior_attrs. prefix. Reference Terraform arguments such as provider and module sources with the meta. prefix. Refer to the individual policy and test block reference pages for a list of supported attributes and meta-arguments.

Operators

Terraform policy supports most Terraform operators for building conditions and expressions. Refer to Operators for more information.

Functions

Terraform policy includes built-in functions to fetch resources and data sources, as well as most Terraform library functions. Refer to Functions for more information.

Input variables and locals

Terraform policy supports input variables and local values to allow you to parameterize your policy configuration:

• Refer to input to learn how to parameterize your policies with inputs.
• Refer to locals to learn how to use local values.

Plugins

You can write custom Terraform policy functions as plugins in Golang. Refer to Policy plugins for more information.

Next steps

• Review the policy reference documentation for detailed information about each policy block type.
• Learn how to test your policies.
• View example policies.