terraform-policy

Files (55)

• .gitignore
• README.md
• SKILL.md
• README.md · examples/
• README.md · examples/conversion/cloudfront-associated-with-waf/
• cloudfront-associated-with-waf.policy.hcl · examples/conversion/cloudfront-associated-with-waf/
• cloudfront-associated-with-waf.sentinel · examples/conversion/cloudfront-associated-with-waf/
• README.md · examples/conversion/cloudtrail-server-side-encryption-enabled/
• cloudtrail-server-side-encryption-enabled.policy.hcl · examples/conversion/cloudtrail-server-side-encryption-enabled/
• cloudtrail-server-side-encryption-enabled.sentinel · examples/conversion/cloudtrail-server-side-encryption-enabled/
• README.md · examples/conversion/dms-endpoint-should-be-ssl-configured/
• dms-endpoint-should-be-ssl-configured.policy.hcl · examples/conversion/dms-endpoint-should-be-ssl-configured/
• dms-endpoint-should-be-ssl-configured.sentinel · examples/conversion/dms-endpoint-should-be-ssl-configured/
• README.md · examples/conversion/dms-endpoints-should-use-ssl/
• dms-endpoints-should-use-ssl.policy.hcl · examples/conversion/dms-endpoints-should-use-ssl/
• dms-endpoints-should-use-ssl.sentinel · examples/conversion/dms-endpoints-should-use-ssl/
• README.md · examples/conversion/ec2-network-acl-should-have-subnet-ids/
• ec2-network-acl-should-have-subnet-ids.policy.hcl · examples/conversion/ec2-network-acl-should-have-subnet-ids/
• ec2-network-acl-should-have-subnet-ids.sentinel · examples/conversion/ec2-network-acl-should-have-subnet-ids/
• README.md · examples/conversion/ec2-vpc-default-security-group-no-traffic/
• ec2-vpc-default-security-group-no-traffic.policy.hcl · examples/conversion/ec2-vpc-default-security-group-no-traffic/
• ec2-vpc-default-security-group-no-traffic.sentinel · examples/conversion/ec2-vpc-default-security-group-no-traffic/
• README.md · examples/conversion/efs-access-point-should-enforce-user-identity/
• efs-access-point-should-enforce-user-identity.policy.hcl · examples/conversion/efs-access-point-should-enforce-user-identity/
• efs-access-point-should-enforce-user-identity.sentinel · examples/conversion/efs-access-point-should-enforce-user-identity/
• README.md · examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/
• elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl · examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/
• elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel · examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/
• README.md · examples/conversion/elasticsearch-encrypted-at-rest/
• elasticsearch-encrypted-at-rest.policy.hcl · examples/conversion/elasticsearch-encrypted-at-rest/
• elasticsearch-encrypted-at-rest.sentinel · examples/conversion/elasticsearch-encrypted-at-rest/
• README.md · examples/conversion/elasticsearch-https-required/
• elasticsearch-https-required.policy.hcl · examples/conversion/elasticsearch-https-required/
• elasticsearch-https-required.sentinel · examples/conversion/elasticsearch-https-required/
• README.md · examples/conversion/elasticsearch-in-vpc-only/
• elasticsearch-in-vpc-only.policy.hcl · examples/conversion/elasticsearch-in-vpc-only/
• elasticsearch-in-vpc-only.sentinel · examples/conversion/elasticsearch-in-vpc-only/
• README.md · examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/
• eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl · examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/
• eventbridge-custom-event-bus-should-have-attached-policy.sentinel · examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/
• README.md · examples/conversion/s3-block-public-access-bucket-level/
• s3-block-public-access-bucket-level.policy.hcl · examples/conversion/s3-block-public-access-bucket-level/
• s3-block-public-access-bucket-level.sentinel · examples/conversion/s3-block-public-access-bucket-level/
• README.md · examples/conversion/s3-bucket-should-have-object-lock-enabled/
• s3-bucket-should-have-object-lock-enabled.policy.hcl · examples/conversion/s3-bucket-should-have-object-lock-enabled/
• s3-bucket-should-have-object-lock-enabled.sentinel · examples/conversion/s3-bucket-should-have-object-lock-enabled/
• README.md · examples/conversion/secretsmanager-auto-rotation-enabled-check/
• secretsmanager-auto-rotation-enabled-check.policy.hcl · examples/conversion/secretsmanager-auto-rotation-enabled-check/
• secretsmanager-auto-rotation-enabled-check.sentinel · examples/conversion/secretsmanager-auto-rotation-enabled-check/
• README.md · examples/conversion/step-functions-state-machine-logging-enabled/
• step-functions-state-machine-logging-enabled.policy.hcl · examples/conversion/step-functions-state-machine-logging-enabled/
• step-functions-state-machine-logging-enabled.sentinel · examples/conversion/step-functions-state-machine-logging-enabled/
• tfpolicy-author.md · references/
• tfpolicy-test.md · references/
• verified-syntax.md · references/

SKILL.md (first lines)

# terraform-policy

**UTILITY SKILL** — INVOKES: [tfpolicy-author](references/tfpolicy-author.md) | [tfpolicy-test](references/tfpolicy-test.md)

## USE FOR:

- Writing a new `.policy.hcl` policy from a description or requirement
- Converting a `.sentinel` policy to Terraform Policy
- Writing or debugging a `.policytest.hcl` test file
- Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed `tfpolicy` CLI version and tailor guidance accordingly. This skill maintains guidance for the two most recent minor lines, `0.2.x` and `0.3.x`; when a new minor ships, drop the oldest line and add the new one.
- If the CLI is `0.2.x` (baseline), include a top-level `policy { required_providers { ... } }` block when authoring `.policy.hcl` files containing resource or provider policies. It is mandatory for `tfpolicy validate`; version-range validation is best effort, and wildcard targets such as `resource_policy "*"` are not schema-validated. `tfpolicy test` does not preflight mocked `attrs`/`prior_attrs` against provider schemas, `core::alltrue`/`core::anytrue` do not exist, and, only in this `0.2.x` line, mock `resource {}` blocks may omit `attrs`/`prior_attrs` entirely.
- If the CLI is `0.3.x` or newer, the other guidance above still applies, but the `0.2.x` allowance for omitting resource state does not: every mock `resource {}` block in `.policytest.hcl` files must declare `attrs` or `prior_attrs`; if both evaluate to empty, the test case is skipped (`provider {}` and `module {}` mocks are unaffected) (see [tfpolicy-test](references/tfpolicy-test.md#every-resource--mock-must-declare-a-non-empty-state-block-tfpolicy-030)). `tfpolicy test` reuses the target `.policy.hcl`'s existing top-level `policy { required_providers { ... } }` block (there is no separate `.policytest.hcl`-level declaration) to validate provider, resource, and data-source policies and `core::getdatasource()`/`core::getresources()` arguments against resolved provider schemas before any test runs, failing the whole run on a schema mismatch (see [tfpolicy-test](references/tfpolicy-test.md#test-execution-behavior)). `core::alltrue(list)` and `core::anytrue(list)` are also available — prefer them over the `core::length()` list-comprehension workaround (see [tfpolicy-author](references/tfpolicy-author.md#core-functions--common-idioms)). `meta.tfe_stack` and `meta.tfe_workspace.tags` are available to resource, provider, and module policies; Stack fields are empty outside Stack evaluations.
- If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the `0.2.x` and `0.3.x` paths.

## DO NOT USE FOR:

- Writing `.tftest.hcl` files for Terraform modules — use `terraform-test`
- General Terraform HCL authoring — use `terraform-style-guide`

## Routing

| Task | Sub-skill |
|------|-----------|
| Write or convert a `.policy.hcl` policy | [tfpolicy-author](references/tfpolicy-author.md) |
| Write or debug a `.policytest.hcl` test | [tfpolicy-test](references/tfpolicy-test.md) |

## Examples

- "Block EC2 instances without encryption" → [tfpolicy-author](references/tfpolicy-author.md)
- "Convert this Sentinel policy to tfpolicy" → [tfpolicy-author](references/tfpolicy-author.md)
- "Write a policytest for my EBS policy" → [tfpolicy-test](references/tfpolicy-test.md)

## Troubleshooting

- **Wrong skill triggered?** Load the sub-skill directly from the routing table above.

```bash
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test
```

From hashicorp/agent-skills, MPL-2.0.

More from hashicorp/agent-skills