How to pull all resources in a plan about terraform-guides HOT 4 CLOSED

Hello! Please see the below snippets of code you can use to help build Sentinel policies like this:

Example Sentinel function to iterate over all resources in plan

kubernetes_namespaces = func() {
	namespaces = []
	// Iterate over all the resources in the Terraform plan and
	// find kubernetes_namespace resource
	for tfplan.resources as type, resource {
		if type is "kubernetes_namespace" {
			namespaces += [resource]
		}
	}

	// Return a list of kubernetes namespaces found in the Terraform plan
	return namespaces
}

Example Sentinel logic to check for existence of mandatory tags

mandatory_tags = [
  "TTL", 
  "Owner",
]

# Instance tag rule
instance_tags = rule {
    all aws_instances as _, instances {
    	all instances as index, r {
            all mandatory_tags as t {
                r.applied.tags contains t
            }
        }
    }
}

from terraform-guides.

Thanks for your snippet. I also tried many ways to compare two lists, for example, I wanted to compare list of security group ids of a vm with a mandatory_security_groups list and verify if all mandatory security groups are there. I took the mandatory_tags example and modified but could not achieve. Could you help me here.

from terraform-guides.

I get an error with your snippet, "only a list or map can be indexed, got undefined"

from terraform-guides.

@rajagopalanrg : sorry for the long delay responding to this post.

The third-generation policies have sentinel modules like tfplan-functions.sentinel and tfconfig-functions.sentinel that have various functions. Each function is documented in a separate file.

The tfplan-functions module does have find_resources_by_provider and find_datasources_by_provider. There are similar functions in the tfconfig-functions module.

Also, I recently updated the third-generation policies that validate that certain labels are on resources of many types for AWS and Azure:

• https://github.com/hashicorp/terraform-guides/blob/master/governance/third-generation/aws/enforce-mandatory-tags.sentinel
• https://github.com/hashicorp/terraform-guides/blob/master/governance/third-generation/azure/enforce-mandatory-tags.sentinel

The policy for GCP is still restricted to a single resource type:

• https://github.com/hashicorp/terraform-guides/blob/master/governance/third-generation/gcp/enforce-mandatory-labels.sentinel

Roger Berlind
Global Technology Specialist
HashiCorp

from terraform-guides.