terraform-policy

.DS_Store
__pycache__/
*.pyc

Terraform Policy Agent Skills

A family of focused agent skills for working with Terraform Policy — HCP Terraform's native policy-as-code engine for .policy.hcl and .policytest.hcl files.

Routing

Pick the skill that matches the user's journey:

Repository layout

terraform-policy/
├── SKILL.md                        # Router — routes to references below
├── references/
│   ├── tfpolicy-author.md          # Authoring + Sentinel conversion (v0.2.0)
│   ├── tfpolicy-test.md            # Testing + full testing guide
│   └── verified-syntax.md         # Shared source-of-truth syntax reference
├── examples/
│   └── conversion/                 # Side-by-side .sentinel / .policy.hcl examples
└── evals/
    ├── eval.yaml
    └── tasks/

Shared reference

references/verified-syntax.md (references/verified-syntax.md) is the single source of truth for verified Terraform Policy syntax, function names, and runtime limitations. All reference files link to it rather than duplicating facts — when reference content disagrees with this file, the reference wins.

Required provider declarations for .policy.hcl

Authored .policy.hcl files must include a top-level policy { required_providers { ... } } block. tfpolicy validate uses these declarations for schema-aware validation, and validation fails if the block is omitted.

For version ranges, validation is best effort: provider schemas at the lower and upper bounds of the declared range are evaluated. Wildcard targets such as resource_policy "*" are not schema-validated because they may match multiple resource types.

Starting in tfpolicy 0.3.0, tfpolicy test reuses this same .policy.hcl declaration to preflight the attrs/prior_attrs values mocked in the corresponding .policytest.hcl file against resolved provider schemas — .policytest.hcl does not declare its own required_providers block.

See:

• references/tfpolicy-author.md (references/tfpolicy-author.md) for authoring guidance and examples
• references/verified-syntax.md (references/verified-syntax.md) for syntax and validation limitations

Versioning

Each reference is versioned independently via its metadata.version field.

License

MPL-2.0. Copyright IBM Corp. 2026.

Sentinel to tfpolicy Conversion Examples

This folder packages representative Sentinel-to-tfpolicy conversion examples for sharing with teammates.

Each example subfolder contains:

• <sentinel-policy-name>.sentinel - the actual Sentinel policy file included for comparison
• <sentinel-policy-name>.policy.hcl - the tfpolicy version or best approximation
• README.md - explanation of the conversion quality, what changed, and any limitations

Converted tfpolicy examples in this bundle prefer remediation-focused diagnostics over repeating Terraform addresses from Sentinel summary {} output. Terraform Policy diagnostics already identify the failing object and point to the relevant location, so converted examples avoid ${meta.address} in error messages.

Included examples:

• dms-endpoints-should-use-ssl - direct attribute conversion (Perfect)
• elasticsearch-https-required - nested block conversion (Good)
• eventbridge-custom-event-bus-should-have-attached-policy - cross-resource conversion via core::getresources() (Limited)
• cloudfront-associated-with-waf - approximation only due to missing reference metadata (Not convertible as an exact translation)
• efs-access-point-should-enforce-user-identity - direct presence check (Perfect)
• elasticsearch-encrypted-at-rest - nested encryption block check (Good)
• dms-endpoint-should-be-ssl-configured - config-derived certificate check (Good)
• ec2-network-acl-should-have-subnet-ids - association-aware approximation (Limited)
• secretsmanager-auto-rotation-enabled-check - secret-to-rotation relationship via core::getresources() (Good)
• s3-bucket-should-have-object-lock-enabled - object lock association approximation (Limited)
• ec2-vpc-default-security-group-no-traffic - inline-only approximation of a broader graph check (Not convertible as an exact translation)
• elasticsearch-in-vpc-only - config-to-end-state VPC placement approximation (Limited)
• cloudtrail-server-side-encryption-enabled - config-to-end-state encryption check (Good)
• step-functions-state-machine-logging-enabled - nested logging block conversion (Good)
• elasticache-redis-replication-group-encryption-at-transit-enabled - direct boolean check (Perfect)
• s3-block-public-access-bucket-level - variable and association heavy approximation (Not convertible as an exact translation)

Note: The Sentinel policy files in this bundle come from the locally cloned policy library so reviewers can inspect the original Sentinel and converted tfpolicy side by side in one place.

CloudFront Associated with WAF

Source Sentinel Policy

cloudfront-associated-with-waf.sentinel

Conversion Quality

Not convertible as an exact translation

What the approximation does

The included tfpolicy approximation checks only that web_acl_id is set to a non-empty value on aws_cloudfront_distribution resources.

Why exact conversion is not possible today

The Sentinel policy uses tfconfig/v2 plus reference metadata (references) to reason about whether the CloudFront distribution is associated with a WAF resource. Current tfpolicy guidance does not expose equivalent reference metadata, so it cannot distinguish:

• literal values
• references to WAF resources
• computed values

Key limitation

This means tfpolicy can enforce presence of a web_acl_id, but it cannot safely reproduce the Sentinel policy's reference-aware behavior.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: cloudfront-associated-with-waf.sentinel
# Exact conversion quality: Not convertible
# This tfpolicy only checks for a non-empty web_acl_id value.

resource_policy "aws_cloudfront_distribution" "require_web_acl_id" {
    locals {
        web_acl_id = core::try(attrs.web_acl_id, "")
    }

    enforce {
        condition = local.web_acl_id != ""
        error_message = "CloudFront distributions should set web_acl_id to associate a WAF or WAF Classic ACL"
    }
}

// This policy checks whether 'aws_cloudfront_distribution' are associated with either AWS WAF Classic or AWS WAF web ACLs.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

// Imports

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

// Constants

const = {
	"policy_name": "cloudfront-associated-with-waf",
	"message":     "'aws_cloudfront_distribution' are associated with either AWS WAF Classic or AWS WAF web ACLs. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-6 for more details.",
	"resource_aws_cloudfront_distribution": "aws_cloudfront_distribution",
}

// Functions

get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		web_acl_id = maps.get(res.config, "web_acl_id", {})
		if web_acl_id is null or web_acl_id is empty {
			return false
		}
		references = maps.get(web_acl_id, "references", [])
		return references is not empty
	})
}

// Variables

config_resources = tf.config(tfconfig.resources)
cloudfront_distribution_resource = config_resources.type(const.resource_aws_cloudfront_distribution).resources

violations = get_violations(cloudfront_distribution_resource)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

// Outputs

print(report.generate_policy_report(summary))

// Rules

main = rule {
	violations is empty
}

CloudTrail Server-Side Encryption Enabled

Source Sentinel Policy

cloudtrail-server-side-encryption-enabled.sentinel

Conversion Quality

Good

Why this is Good

The Sentinel policy is config-oriented and checks whether kms_key_id is present as a configured value. tfpolicy can preserve the same enforcement intent by validating the planned end-state value for attrs.kms_key_id.

Key translation notes

• tfconfig/v2 config inspection becomes a planned-value check in tfpolicy
• The converted policy focuses on whether kms_key_id is ultimately present, not whether it originated as a constant in the config

Limitations encountered

The tfpolicy version does not preserve the config-level distinction between explicit constant values and other configuration forms. It validates the final planned attribute value instead.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: cloudtrail-server-side-encryption-enabled.sentinel
# Conversion quality: Good

resource_policy "aws_cloudtrail" "cloudtrail_server_side_encryption_enabled" {
    locals {
        kms_key_id = core::try(attrs.kms_key_id, "")
    }

    enforce {
        condition = local.kms_key_id != ""
        error_message = "CloudTrail resources must set kms_key_id for server-side encryption"
    }
}

# This policy requires that resources of type `aws_cloudtrail` have server-side encryption enabled.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants

const = {
	"resource_aws_cloudtrail":         "aws_cloudtrail",
	"policy_name":                     "cloudtrail-server-side-encryption-enabled",
	"message":                         "Attribute 'kms_key_id' must be present for 'aws_cloudtrail' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-2 for more details.",
	"cloudtrail_attribute_kms_key_id": "kms_key_id",
	"constant_value":                  "constant_value",
}

# Variables

resources = tf.config(tfconfig.resources).type(const.resource_aws_cloudtrail).resources

violations = collection.reject(resources, func(res) {
	key_path = "config.kms_key_id"
	return maps.get(res, key_path, false) is not false and
		maps.get(res, key_path + "." + const.constant_value, false) is not ""
})

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

DMS Endpoint Should Be SSL Configured

Source Sentinel Policy

dms-endpoint-should-be-ssl-configured.sentinel

Conversion Quality

Good

Why this converts reasonably well

The Sentinel version uses tfconfig/v2 to accept either a constant value or a reference for certificate_arn. tfpolicy cannot inspect Terraform config reference metadata the same way, but it can still validate that the planned certificate_arn value is non-empty.

Key translation notes

• Config-oriented Sentinel checks become an end-state tfpolicy check on attrs.certificate_arn
• tfpolicy focuses on the resulting planned value instead of whether it came from a literal or a reference

Limitations encountered

The tfpolicy version does not preserve the source-level distinction between constant values and references. It only checks that the final planned value is present.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: dms-endpoint-should-be-ssl-configured.sentinel
# Conversion quality: Good

resource_policy "aws_dms_endpoint" "dms_endpoint_should_be_ssl_configured" {
    locals {
        certificate_arn = core::try(attrs.certificate_arn, "")
    }

    enforce {
        condition = local.certificate_arn != ""
        error_message = "DMS endpoints should set certificate_arn for SSL configuration"
    }
}

# This policy checks if resources of type 'aws_dms_endpoint' have the 'certificate_arn'
# shouldn't be empty

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants
const = {
	"policy_name":               "dms-endpoint-should-be-ssl-configured",
	"message":                   "Attribute 'certificate_arn' shouldn't be empty for AWS DMS Endpoint. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-9 for more details.",
	"resource_aws_dms_endpoint": "aws_dms_endpoint",
}

# Functions

get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		certificate_arn_values = maps.get(res, "config.certificate_arn", "")
		if certificate_arn_values is empty {
			return false
		}
		return maps.get(certificate_arn_values, "constant_value", "") is not empty or maps.get(certificate_arn_values, "references", "") is not empty
	})
}

# Variables

dms_endpoint_resource = tf.config(tfconfig.resources).type(const.resource_aws_dms_endpoint).resources
violations = get_violations(dms_endpoint_resource)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs
print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

DMS Endpoint SSL Mode

Source Sentinel Policy

dms-endpoints-should-use-ssl.sentinel

Conversion Quality

Perfect

Why it converts well

This policy is a straightforward single-resource attribute check. The Sentinel version iterates over aws_dms_endpoint resources and rejects any resource whose ssl_mode is not in an allowlist. tfpolicy can express the same intent directly with one resource_policy, one allowlist, and one enforce block.

Key translation notes

• Sentinel collection.reject() becomes one positive condition
• maps.get(res, "values.ssl_mode", null) becomes core::try(attrs.ssl_mode, "")
• No cross-resource logic, state inspection, or reference metadata is involved

Limitations encountered

No significant tfpolicy limitation blocks this conversion.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: dms-endpoints-should-use-ssl.sentinel
# Conversion quality: Perfect

resource_policy "aws_dms_endpoint" "require_ssl_mode" {
    locals {
        ssl_mode = core::try(attrs.ssl_mode, "")
        valid_ssl_modes = ["require", "verify-ca", "verify-full"]
    }

    enforce {
        condition = core::contains(local.valid_ssl_modes, local.ssl_mode)
        error_message = "DMS endpoints must set ssl_mode to one of: require, verify-ca, verify-full"
    }
}

# This policy requires resources of type `aws_dms_endpoint` have attribute "ssl_mode" set to one of: require, verify-ca, verify-full.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants

const = {
	"policy_name":               "dms-ssl-enabled",
	"message":                   "Attribute 'ssl_mode' must be set to one of: require, verify-ca, verify-full for 'aws_dms_endpoint' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-9 for more details.",
	"resource_aws_dms_endpoint": "aws_dms_endpoint",
	"ssl_mode":                  "ssl_mode",
	"valid_ssl_modes":           ["require", "verify-ca", "verify-full"],
}

# Variables

resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_dms_endpoint).resources
violations = collection.reject(resources, func(res) {
	return maps.get(res, "values." + const.ssl_mode, null) in const.valid_ssl_modes
})

summary = {
	"policy_name": "dms-ssl-enabled",
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

EC2 Network ACL Should Have Subnet IDs

Source Sentinel Policy

ec2-network-acl-should-have-subnet-ids.sentinel

Conversion Quality

Limited

Why this is limited

The Sentinel policy uses tfconfig/v2, reference metadata, and module-aware address reconstruction to determine whether a network ACL is connected through aws_network_acl_association. Current tfpolicy guidance does not expose equivalent reference metadata, so an exact translation is not possible.

What the approximation does

The tfpolicy version checks either:

• subnet_ids is present directly on the network ACL, or
• a matching aws_network_acl_association can be found via core::getresources() and a value-based lookup

Limitations encountered

• This is value matching, not true Terraform graph reasoning
• It may behave differently for newly created resources with unresolved values
• It does not reproduce the Sentinel policy's module-aware reference reconstruction exactly

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: ec2-network-acl-should-have-subnet-ids.sentinel
# Exact conversion quality: Limited

locals {
    all_network_acl_associations = core::getresources("aws_network_acl_association", {})
    associated_network_acl_ids = {
        for association in local.all_network_acl_associations :
        core::try(association.network_acl_id, "") => true
    }
}

resource_policy "aws_network_acl" "network_acl_should_have_subnet_ids" {
    locals {
        subnet_ids = core::try(attrs.subnet_ids, [])
        has_subnet_ids = core::length(local.subnet_ids) > 0
        network_acl_id = core::try(attrs.id, "")
        has_association = core::try(local.associated_network_acl_ids[local.network_acl_id], false)
    }

    enforce {
        condition = local.has_subnet_ids || local.has_association
        error_message = "Network ACLs should define subnet_ids directly or have a matching aws_network_acl_association"
    }
}

// This policy requires `aws_network_acl` resources to have 'subnet_ids' present.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

// Imports

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps
import "strings"

// Constants

const = {
	"policy_name":                          "ec2-network-acl-should-have-subnet-ids",
	"message":                              "Attribute 'subnet_ids' must be present for 'aws_network_acl' resources or it should include 'subnet_ids' through 'aws_network_acl_association'. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16 for more details.",
	"resource_aws_network_acl":             "aws_network_acl",
	"resource_aws_network_acl_association": "aws_network_acl_association",
	"subnet_ids":                           "subnet_ids",
	"constant_value":                       "constant_value",
	"module_prefix":                        "module.",
}

// Functions

get_violations = func(network_acl_resources, network_acl_association_resources) {
	return collection.reject(network_acl_resources, func(res) {
		subnet_id_values = maps.get(res, "config." + const.subnet_ids, [])
		if (subnet_id_values is empty or subnet_id_values.constant_value is defined) and check_network_acl_association(res.address, network_acl_association_resources) {
			return false
		}
		return true
	})
}

check_network_acl_association = func(address, network_acl_association_resources) {
	if network_acl_association_resources is empty {
		return true
	}
	return collection.find(network_acl_association_resources, func(res) {
		network_acl_id_reference = get_referenced_resource_address(res, "config.network_acl_id")
		if network_acl_id_reference is empty {
			return false
		}
		return address is network_acl_id_reference
	}) is not defined
}

get_referenced_resource_address = func(res, attr) {
	references_list = maps.get(res, attr, [])
	if references_list.references is empty {
		return ""
	}
	referenced_address = references_list.references[1]
	if strings.has_prefix(res.address, const.module_prefix) {
		referenced_address = res.module_address + "." + referenced_address
	}
	return referenced_address
}

// Variables

config_resources = tf.config(tfconfig.resources)
network_acl_resources = config_resources.type(const.resource_aws_network_acl).resources
network_acl_association_resources = config_resources.type(const.resource_aws_network_acl_association).resources

violations = get_violations(network_acl_resources, network_acl_association_resources)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

// Outputs

print(report.generate_policy_report(summary))

// Rules

main = rule {
	violations is empty
}

EC2 VPC Default Security Group No Traffic

Source Sentinel Policy

ec2-vpc-default-security-group-no-traffic.sentinel

Conversion Quality

Not convertible as an exact translation

What the approximation does

The included tfpolicy checks only inline ingress and egress rules on aws_default_security_group resources.

Why exact conversion is not possible today

The Sentinel policy combines several config-level resource types:

• aws_default_security_group
• aws_security_group_rule
• aws_vpc_security_group_ingress_rule
• aws_vpc_security_group_egress_rule

It then uses tfconfig/v2 reference metadata and regex checks to determine whether those separate rule resources target the default security group of a VPC. Current tfpolicy guidance does not expose equivalent config graph metadata, so it cannot safely reproduce that full relationship-aware behavior.

Key limitation

This means tfpolicy can approximate the inline-rule case, but it cannot fully enforce the broader Sentinel policy that also reasons over separate security group rule resources attached by reference.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: ec2-vpc-default-security-group-no-traffic.sentinel
# Exact conversion quality: Not convertible
# This tfpolicy only checks inline ingress/egress on aws_default_security_group resources.

resource_policy "aws_default_security_group" "ec2_vpc_default_security_group_no_traffic" {
    locals {
        ingress_rules = core::try(attrs.ingress, [])
        egress_rules = core::try(attrs.egress, [])
    }

    enforce {
        condition = core::length(local.ingress_rules) == 0
        error_message = "Default security groups should not allow inline ingress traffic"
    }

    enforce {
        condition = core::length(local.egress_rules) == 0
        error_message = "Default security groups should not allow inline egress traffic"
    }
}

# This policy requires resources of type `aws_vpc` to have no traffic for default security group.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants

const = {
	"message":                             "VPC default security group should not allow inbound and outbound traffic. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2 for more details.",
	"policy_name":                         "ec2-vpc-default-security-group-no-traffic",
	"config":                              "config",
	"security_group_id":                   "security_group_id",
	"references":                          "references",
	"constant_value":                      "constant_value",
	"resource_aws_default_security_group": "aws_default_security_group",
	"ingress":                                      "ingress",
	"egress":                                       "egress",
	"resource_aws_vpc":                             "aws_vpc",
	"resource_aws_default_vpc":                     "aws_default_vpc",
	"resource_aws_security_group_rule":             "aws_security_group_rule",
	"resource_aws_vpc_security_group_ingress_rule": "aws_vpc_security_group_ingress_rule",
	"resource_aws_vpc_security_group_egress_rule":  "aws_vpc_security_group_egress_rule",
}

# Functions

is_default_security_group_of_vpc = func(reference) {
	return reference matches "aws_default_security_group.(.*).id" or
		reference matches "aws_vpc.(.*).default_security_group_id$" or
		reference matches "aws_default_vpc.(.*).default_security_group_id$"
}

filter_security_group_rule_violations = func(sg_rule_resources) {
	return collection.reject(sg_rule_resources, func(r) {
		key = "config.security_group_id.references"
		val = maps.get(r, key, undefined)
		return !(val is defined and length(val) > 0 and is_default_security_group_of_vpc(val[0]))
	})
}

# Variables

config_resources = tf.config(tfconfig.resources)

default_security_group_resources = config_resources.type(const.resource_aws_default_security_group).resources

violations = []

violations += collection.reject(default_security_group_resources, func(r) {
	ingress_key = const.config + "." + const.ingress + "." + const.constant_value
	egress_key = const.config + "." + const.egress + "." + const.constant_value
	ingress_key_val = maps.get(r, ingress_key, undefined)
	egress_key_val = maps.get(r, egress_key, undefined)
	return !((ingress_key_val is defined and length(ingress_key_val) > 0) or
		(egress_key_val is defined and length(egress_key_val) > 0))
})

aws_security_group_rule_resources = config_resources.type(const.resource_aws_security_group_rule).resources
violations += filter_security_group_rule_violations(aws_security_group_rule_resources)

aws_security_group_ingress_rule_resources = config_resources.type(const.resource_aws_vpc_security_group_ingress_rule).resources
violations += filter_security_group_rule_violations(aws_security_group_ingress_rule_resources)

aws_security_group_egress_rule_resources = config_resources.type(const.resource_aws_vpc_security_group_egress_rule).resources
violations += filter_security_group_rule_violations(aws_security_group_egress_rule_resources)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

EFS Access Point Should Enforce User Identity

Source Sentinel Policy

efs-access-point-should-enforce-user-identity.sentinel

Conversion Quality

Perfect

Why it converts well

This is a simple presence check on a single planned resource type. The Sentinel policy rejects aws_efs_access_point resources that do not define posix_user, and tfpolicy can express that directly with one resource_policy and one enforce block.

Key translation notes

• maps.get(res.values, "posix_user", {}) is not empty becomes core::try(attrs.posix_user, null) != null
• No cross-resource reasoning or reference metadata is required

Limitations encountered

No significant tfpolicy limitation blocks this conversion.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: efs-access-point-should-enforce-user-identity.sentinel
# Conversion quality: Perfect

resource_policy "aws_efs_access_point" "efs_access_point_should_enforce_user_identity" {
    enforce {
        condition = core::try(attrs.posix_user, null) != null
        error_message = "EFS access points must define posix_user"
    }
}

# This policy requires resources of type `aws_efs_access_point` have attribute `posix_user` should be defined.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants

const = {
	"policy_name":                   "efs-access-point-should-enforce-user-identity",
	"message":                       "Attribute 'posix_user' should be defined for 'aws_efs_access_point' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/efs-controls.html#efs-4 for more details.",
	"resource_aws_efs_access_point": "aws_efs_access_point",
	"posix_user":                    "posix_user",
}

# Variables

resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_efs_access_point).resources

violations = collection.reject(resources, func(res) {
	return maps.get(res.values, const.posix_user, {}) is not empty
})

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

ElastiCache Redis Replication Group Encryption at Transit Enabled

Source Sentinel Policy

elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel

Conversion Quality

Perfect

Why it converts well

This is a direct boolean check on a single planned resource type. The Sentinel logic checks whether transit_encryption_enabled is true on aws_elasticache_replication_group, and tfpolicy can express the same rule directly.

Key translation notes

• maps.get(res, "values.transit_encryption_enabled", ...) becomes core::try(attrs.transit_encryption_enabled, false)
• No resource graph traversal, config metadata, or cross-resource matching is required

Limitations encountered

No significant tfpolicy limitation blocks this conversion.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel
# Conversion quality: Perfect

resource_policy "aws_elasticache_replication_group" "elasticache_redis_replication_group_encryption_at_transit_enabled" {
    enforce {
        condition = core::try(attrs.transit_encryption_enabled, false) == true
        error_message = "ElastiCache replication groups must enable transit_encryption_enabled"
    }
}

# This policy requires that the `transit_encryption_enabled` attribute of the `aws_elasticache_replication_group` resource is true.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants
const = {
	"policy_name":                                "elasticache-redis-replication-group-encryption-at-rest-enabled",
	"resource_aws_elasticache_replication_group": "aws_elasticache_replication_group",
}

# Functions
get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		key = "values.transit_encryption_enabled"
		return maps.has(res, key) and maps.get(res, key) is true
	})
}

# Variables

elasticache_replication_groups = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_elasticache_replication_group).resources
violations = get_violations(elasticache_replication_groups)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        "Attribute 'transit_encryption_enabled' must be true for 'aws_elasticache_replication_group' resources.Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/elasticache-controls.html#elasticache-5 for more details.",
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

Elasticsearch Encrypted at Rest

Source Sentinel Policy

elasticsearch-encrypted-at-rest.sentinel

Conversion Quality

Good

Why this is Good

The original intent maps cleanly to tfpolicy, but the block shape still has to be rewritten in tfpolicy terms using core::try() around encrypt_at_rest[0].enabled.

Key translation notes

• Nested map access becomes direct tfpolicy block access
• The conversion checks the planned end state of encrypt_at_rest
• The outcome is preserved even though the syntax changes substantially

Limitations encountered

This depends on the provider exposing encrypt_at_rest in the expected block/list structure. As with other tfpolicy policies, raw provider schema shape matters.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: elasticsearch-encrypted-at-rest.sentinel
# Conversion quality: Good

resource_policy "aws_elasticsearch_domain" "elasticsearch_encrypted_at_rest" {
    locals {
        encrypt_at_rest = core::try(attrs.encrypt_at_rest, [])
        encryption_enabled = core::try(local.encrypt_at_rest[0].enabled, false)
    }

    enforce {
        condition = local.encryption_enabled == true
        error_message = "Elasticsearch domains must enable encrypt_at_rest"
    }
}

# This policy requires resources of type `aws_elasticsearch_domain` have the `encrypt_at_rest` should have 'enabled' attribute set to `true`.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Import

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants
const = {
	"policy_name":                       "elasticsearch-encrypted-at-rest",
	"message":                           "Attribute 'enabled' must be set to true for the attribute 'encrypt_at_rest' for 'aws_elasticsearch_domain' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html#es-1 for more details.",
	"resource_aws_elasticsearch_domain": "aws_elasticsearch_domain",
}

# Functions

get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		encrypt_at_rest_values = maps.get(res, "values.encrypt_at_rest", [])
		return encrypt_at_rest_values is not empty and encrypt_at_rest_values[0].enabled is true
	})
}

# Variables

elasticsearch_resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_elasticsearch_domain).resources
violations = get_violations(elasticsearch_resources)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

Elasticsearch HTTPS Required

Source Sentinel Policy

elasticsearch-https-required.sentinel

Conversion Quality

Good

Why it is not labeled Perfect

The enforcement intent is preserved, but the structure changes more noticeably than in a simple attribute check. The Sentinel version uses helper functions plus nested map lookups. The tfpolicy version rewrites that logic into direct block access with core::try() and separate enforce blocks.

Key translation notes

• Nested maps.get() calls become core::try(local.endpoint_options[0]....)
• One compound Sentinel predicate becomes multiple focused enforce blocks
• The end-state requirement is preserved clearly in tfpolicy

Limitations encountered

This conversion depends on provider schema shape for domain_endpoint_options. As with other tfpolicy policies, block/list/set handling must match the exposed schema exactly.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: elasticsearch-https-required.sentinel
# Conversion quality: Good

resource_policy "aws_elasticsearch_domain" "https_required" {
    locals {
        endpoint_options = core::try(attrs.domain_endpoint_options, [])
        endpoint_options_present = core::length(local.endpoint_options) > 0
        enforce_https = core::try(local.endpoint_options[0].enforce_https, false)
        tls_security_policy = core::try(local.endpoint_options[0].tls_security_policy, "")
    }

    enforce {
        condition = local.endpoint_options_present
        error_message = "Elasticsearch domains must define domain_endpoint_options"
    }

    enforce {
        condition = local.enforce_https == true
        error_message = "Elasticsearch domains must set domain_endpoint_options.enforce_https = true"
    }

    enforce {
        condition = local.tls_security_policy == "Policy-Min-TLS-1-2-PFS-2023-10"
        error_message = "Elasticsearch domains must use tls_security_policy 'Policy-Min-TLS-1-2-PFS-2023-10'"
    }
}

# This policy requires resources of type `aws_elasticsearch_domain` have the `tls_security_policy` set to latest policy that is 'Policy-Min-TLS-1-2-PFS-2023-10' and 'enforce_https' set to true for `domain_endpoint_options` attribute.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Import

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Params
param master_count_value default 3

# Constants
const = {
	"policy_name":                       "elasticsearch-https-required",
	"message":                           "Attribute 'tls_security_policy' must be set to latest policy that is 'Policy-Min-TLS-1-2-PFS-2023-10' and 'enforce_https' set to true for the attribute 'domain_endpoint_options' for 'aws_elasticsearch_domain' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html#es-8 for more details.",
	"resource_aws_elasticsearch_domain": "aws_elasticsearch_domain",
	"enforce_https":                     "enforce_https",
	"tls_security_policy":               "tls_security_policy",
	"allowed_tls_latest_policy":         "Policy-Min-TLS-1-2-PFS-2023-10",
}

# Functions

get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		domain_endpoint_options_values = maps.get(res, "values.domain_endpoint_options", [])
		if domain_endpoint_options_values is empty {
			return false
		}
		tls_security_policy_value = maps.get(domain_endpoint_options_values[0], const.tls_security_policy, null)
		enforce_https_value = maps.get(domain_endpoint_options_values[0], const.enforce_https, true)
		if tls_security_policy_value is null {
			return false
		}
		return enforce_https_value is true and tls_security_policy_value == const.allowed_tls_latest_policy
	})
}

# Variables

elasticsearch_resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_elasticsearch_domain).resources
violations = get_violations(elasticsearch_resources)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

Elasticsearch In VPC Only

Source Sentinel Policy

elasticsearch-in-vpc-only.sentinel

Conversion Quality

Limited

Why this is limited

The Sentinel policy is config-oriented and accepts either constant subnet IDs or references inside vpc_options.subnet_ids. tfpolicy does not expose the same config-level constant_value and references metadata, so it cannot preserve that distinction exactly.

What the tfpolicy approximation does

The tfpolicy version checks the planned end state and requires vpc_options[0].subnet_ids to contain one or more values.

Limitations encountered

• It validates the resulting planned subnet IDs, not whether they originated from constants vs references
• It assumes the provider exposes vpc_options and subnet_ids in the expected schema shape
• It is a useful enforcement approximation, but not a one-to-one tfconfig translation

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: elasticsearch-in-vpc-only.sentinel
# Exact conversion quality: Limited

resource_policy "aws_elasticsearch_domain" "elasticsearch_in_vpc_only" {
    locals {
        vpc_options = core::try(attrs.vpc_options, [])
        subnet_ids = core::try(local.vpc_options[0].subnet_ids, [])
    }

    enforce {
        condition = core::length(local.subnet_ids) > 0
        error_message = "Elasticsearch domains should define one or more subnet_ids in vpc_options"
    }
}

# This policy requires resources of type `aws_elasticsearch_domain` have the `subnet_ids` should not be empty inside 'vpc_options'.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Import

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants
const = {
	"policy_name":                       "elasticsearch-in-vpc-only",
	"message":                           "Attribute 'subnet_ids' should not be empty for the attribute 'vpc_options' for 'aws_elasticsearch_domain' resources. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html#es-2 for more details.",
	"resource_aws_elasticsearch_domain": "aws_elasticsearch_domain",
	"subnet_ids":                        "subnet_ids",
	"constant_value":                    "constant_value",
	"references":                        "references",
}

# Functions

get_violations = func(resources) {
	return collection.reject(resources, func(res) {
		vpc_options_values = maps.get(res, "config.vpc_options", [])
		if vpc_options_values is empty {
			return false
		}
		subnet_ids_values = maps.get(vpc_options_values[0], const.subnet_ids, [])
		if subnet_ids_values is empty {
			return false
		}
		return maps.get(subnet_ids_values, const.constant_value, []) is not empty or maps.get(subnet_ids_values, const.references, []) is not empty
	})
}

# Variables

elasticsearch_resources = tf.config(tfconfig.resources).type(const.resource_aws_elasticsearch_domain).resources
violations = get_violations(elasticsearch_resources)

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

EventBridge Bus Must Have Attached Policy

Source Sentinel Policy

eventbridge-custom-event-bus-should-have-attached-policy.sentinel

Conversion Quality

Limited

Why this is only a partial conversion

The Sentinel version can compare planned event bus resources against planned policy resources cleanly inside its own collection-processing model. tfpolicy can approximate that by using core::getresources() and matching on event_bus_name, but this is not a full graph-aware translation.

Key translation notes

• Related resources are discovered with core::getresources("aws_cloudwatch_event_bus_policy", {})
• Matching is done by explicit value (event_bus_name) rather than graph/reference semantics
• A top-level lookup map keeps the tfpolicy example readable and performant

Limitations encountered

• This approach relies on resolved attribute values, not reference metadata
• New resources with unresolved references may not match reliably on initial creation
• core::getresources() is useful for scoped lookups but is not a full replacement for Sentinel graph traversal

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: eventbridge-custom-event-bus-should-have-attached-policy.sentinel
# Conversion quality: Limited

locals {
    all_event_bus_policies = core::getresources("aws_cloudwatch_event_bus_policy", {})
    event_bus_policy_map = {
        for policy in local.all_event_bus_policies :
        policy.event_bus_name => true
    }
}

resource_policy "aws_cloudwatch_event_bus" "require_attached_policy" {
    locals {
        bus_name = core::try(attrs.name, "")
        has_attached_policy = core::try(local.event_bus_policy_map[local.bus_name], false)
    }

    enforce {
        condition = local.has_attached_policy
        error_message = "EventBridge buses must have a matching aws_cloudwatch_event_bus_policy resource"
    }
}

# This policy requires `aws_cloudwatch_event_bus` resources to be attached to a policy.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps
import "strings"

# Constants

const = {
	"policy_name": "eventbridge-custom-event-bus-should-have-attached-policy",
	"message":     "Policy should be attached for 'aws_cloudwatch_event_bus' resource. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/eventbridge-controls.html#eventbridge-3 for more details.",
	"resource_aws_cloudwatch_event_bus_policy": "aws_cloudwatch_event_bus_policy",
	"resource_aws_cloudwatch_event_bus":        "aws_cloudwatch_event_bus",
	"event_bus_name":                           "event_bus_name",
	"name":                                     "name",
}

# Functions

get_bus_name_complaint = func(resources) {
	return collection.reject(resources, func(res) {
		bus_name_values = maps.get(res, "values." + const.event_bus_name, {})
		if bus_name_values is empty {
			return true
		}
		return false
	})
}

# Variables

plan_resources = tf.plan(tfplan.planned_values.resources)
event_bus_policy_resources = plan_resources.type(const.resource_aws_cloudwatch_event_bus_policy).resources
event_bus_resources = plan_resources.type(const.resource_aws_cloudwatch_event_bus).resources

event_bus_complaint = get_bus_name_complaint(event_bus_policy_resources)
if event_bus_complaint is not defined {
	violations = []
}

event_bus_addresses = map event_bus_complaint as _, res {
	maps.get(res, "values." + const.event_bus_name, {})
}

violations = filter event_bus_resources as _, res {
	maps.get(res, "values." + const.name, {}) not in event_bus_addresses
}

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

S3 Block Public Access Bucket Level

Source Sentinel Policy

s3-block-public-access-bucket-level.sentinel

Conversion Quality

Not convertible as an exact translation

What the approximation does

The tfpolicy approximation checks whether an aws_s3_bucket has a matching aws_s3_bucket_public_access_block resource and whether all four public access settings are enabled.

Why exact conversion is not possible today

The Sentinel policy combines:

• tfconfig/v2
• tfconfig-functions
• plan-time variable resolution
• config reference metadata
• module-aware address reconstruction

Current tfpolicy guidance does not expose that full config-analysis surface. In particular, tfpolicy cannot safely reproduce the Sentinel behavior that inspects variable references and configuration graph relationships before values are fully materialized.

Limitations encountered

• The approximation relies on resolved values via core::getresources()
• It cannot reproduce variable-reference evaluation from the Sentinel policy
• It may differ from Sentinel on first creation or heavily parameterized module usage

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: s3-block-public-access-bucket-level.sentinel
# Exact conversion quality: Not convertible

locals {
    all_public_access_blocks = core::getresources("aws_s3_bucket_public_access_block", {})
    compliant_public_access_blocks = {
        for block in local.all_public_access_blocks :
        core::try(block.bucket, "") => (
            core::try(block.ignore_public_acls, false) == true &&
            core::try(block.restrict_public_buckets, false) == true &&
            core::try(block.block_public_acls, false) == true &&
            core::try(block.block_public_policy, false) == true
        )
    }
}

resource_policy "aws_s3_bucket" "s3_block_public_access_bucket_level" {
    locals {
        bucket_name = core::try(attrs.bucket, "")
        block_is_compliant = core::try(local.compliant_public_access_blocks[local.bucket_name], false)
    }

    enforce {
        condition = local.block_is_compliant
        error_message = "S3 buckets should have a matching aws_s3_bucket_public_access_block with all four public access settings enabled"
    }
}

# This policy verifies if the attributes of the 'aws_s3_bucket_public_access_block'
# resource (if present) block public access of an S3 general purpose bucket.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfplan/v2" as plan
import "tfplan-functions" as tfplan
import "tfconfig-functions" as tfconfig
import "tfconfig/v2" as config
import "tfresources" as tf
import "collection/maps" as maps
import "report" as report
import "strings"

# Constants
const = {
	"policy_name":                                "s3-block-public-access-bucket-level",
	"module_address":                             "module_address",
	"address":                                    "address",
	"message":                                    "Bucket level Amazon S3 block public access settings are not compliant. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-8 for more details.",
	"resource_aws_s3_bucket":                     "aws_s3_bucket",
	"module_prefix":                              "module.",
	"resource_aws_s3_bucket_public_access_block": "aws_s3_bucket_public_access_block",
	"public_access_block_settings":               ["ignore_public_acls", "restrict_public_buckets", "block_public_acls", "block_public_policy"],
}

# Functions

is_public_access_setting_enabled = func(config, setting) {
	const_val = maps.get(maps.get(config, setting, {}), "constant_value")
	if const_val is defined {
		return const_val is true
	}
	references = maps.get(maps.get(config, setting, {}), "references")
	if references is defined and tfconfig.is_variable_reference(references[0]) {
		return tfplan.get_variable_value(tfconfig.parse_variable_name_from_reference(references[0])) is true
	}
	return false
}

is_block_public_access_settings_compliant = func(config) {
	return all const.public_access_block_settings as _, setting {
		is_public_access_setting_enabled(config, setting)
	}
}

# Prefixes the referenced s3 bucket's address with
# the module address. This is done because resource
# addresses comprise of module addresses
sanitize_referenced_s3_bucket_address = func(res) {
	module_addr = res[const.module_address]
	if res.config.bucket.constant_value is defined {
		return ""
	}

	bucket_reference = res.config.bucket.references[1]
	# Check for root module
	if not strings.has_prefix(res[const.address], const.module_prefix) {
		return bucket_reference
	}

	return module_addr + "." + bucket_reference
}

# Variables

config_resources = tf.config(config.resources)

compliant_public_access_block_resources = filter config_resources.type(const.resource_aws_s3_bucket_public_access_block).resources as _, res {
	is_block_public_access_settings_compliant(res.config)
}

s3_bucket_addresses = map compliant_public_access_block_resources as _, res {
	sanitize_referenced_s3_bucket_address(res)
}

violations = filter config_resources.type(const.resource_aws_s3_bucket).resources as _, res {
	res.address not in s3_bucket_addresses
}

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

S3 Bucket Should Have Object Lock Enabled

Source Sentinel Policy

s3-bucket-should-have-object-lock-enabled.sentinel

Conversion Quality

Limited

Why this is limited

The Sentinel policy uses tfconfig/v2 plus reference metadata to trace aws_s3_bucket_object_lock_configuration resources back to their aws_s3_bucket resources, including module-aware address reconstruction. tfpolicy does not expose equivalent config graph metadata.

What the tfpolicy approximation does

The tfpolicy version uses core::getresources() to find aws_s3_bucket_object_lock_configuration resources, then matches them to buckets by the resolved bucket value and checks the retention mode.

Limitations encountered

• Matching depends on resolved values, not reference metadata
• Initial creation with unresolved bucket references may not match reliably
• The approximation checks the end-state relationship but cannot reproduce the Sentinel config-graph logic exactly

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: s3-bucket-should-have-object-lock-enabled.sentinel
# Exact conversion quality: Limited

locals {
    all_object_lock_configs = core::getresources("aws_s3_bucket_object_lock_configuration", {})
    object_lock_bucket_map = {
        for config in local.all_object_lock_configs :
        core::try(config.bucket, "") => core::try(config.rule[0].default_retention[0].mode, "")
    }
}

resource_policy "aws_s3_bucket" "s3_bucket_should_have_object_lock_enabled" {
    locals {
        bucket_name = core::try(attrs.bucket, "")
        retention_mode = core::try(local.object_lock_bucket_map[local.bucket_name], "")
        object_lock_enabled = core::contains(["GOVERNANCE", "COMPLIANCE"], local.retention_mode)
    }

    enforce {
        condition = local.object_lock_enabled
        error_message = "S3 buckets should have object lock enabled with default retention mode GOVERNANCE or COMPLIANCE"
    }
}

# S3 Buckets should have object lock enabled

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps
import "strings"
import "types"

# Params

param valid_mode default ["GOVERNANCE", "COMPLIANCE"]

# Constants

const = {
	"policy_name":                                      "s3-bucket-should-have-object-lock-enabled",
	"message":                                          "S3 Buckets should have object lock enabled. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-15 for more details.",
	"resource_aws_s3_bucket":                           "aws_s3_bucket",
	"resource_aws_s3_bucket_object_lock_configuration": "aws_s3_bucket_object_lock_configuration",
	"address":           "address",
	"module_address":    "module_address",
	"module_prefix":     "module.",
	"rule":              "rule",
	"default_retention": "default_retention",
	"mode":              "mode",
}

# Functions

# Prefixes the referenced S3 Bucket's address with
# the module address. This is done because resource
# addresses comprise of module addresses
sanitize_compliant_s3_bucket_address = func(res) {
	module_addr = res[const.module_address]
	if res.config.bucket.constant_value is defined {
		return ""
	}
	rule_block = maps.get(res.config, const.rule, [])
	if rule_block is empty {
		return ""
	}

	default_retention = rule_block[0].default_retention[0]
	if default_retention is empty {
		return ""
	}

	mode = maps.get(default_retention, const.mode, "").constant_value
	if mode is empty or mode not in valid_mode {
		return ""
	}

	s3_bucket_reference = res.config.bucket.references[1]
	# Check for root module
	if not strings.has_prefix(res[const.address], const.module_prefix) {
		return s3_bucket_reference
	}

	return module_addr + "." + s3_bucket_reference
}

# Variables

config_resources = tf.config(tfconfig.resources)
bucket_resources = config_resources.type(const.resource_aws_s3_bucket).resources
bucket_object_lock_resources = config_resources.type(const.resource_aws_s3_bucket_object_lock_configuration).resources

# Get S3 Bucket addresses that have object lock enabled
s3_bucket_addresses_with_object_lock = map bucket_object_lock_resources as _, res {
	sanitize_compliant_s3_bucket_address(res)
}

# Find violations: S3 Buckets that have policy violations
violations = filter bucket_resources as _, res {
	res.address not in s3_bucket_addresses_with_object_lock
}

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

print(report.generate_policy_report(summary))

main = rule {
	violations is empty
}

Secrets Manager Auto Rotation Enabled Check

Source Sentinel Policy

secretsmanager-auto-rotation-enabled-check.sentinel

Conversion Quality

Limited

Why this is limited

The Sentinel policy uses tfconfig/v2 reference metadata to determine whether each aws_secretsmanager_secret is connected to an aws_secretsmanager_secret_rotation resource through config.secret_id. Current tfpolicy guidance does not expose equivalent config-level reference metadata.

What the tfpolicy approximation does

The tfpolicy version uses core::getresources() to collect aws_secretsmanager_secret_rotation resources and matches them to secrets by planned secret_id / id values.

Limitations encountered

• This is value matching, not true Terraform graph reasoning
• It may fail or behave differently when secret identifiers are not resolved yet during creation
• It does not preserve Sentinel's module-aware reference reconstruction exactly

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Approximation of HashiCorp PCI DSS Sentinel example: secretsmanager-auto-rotation-enabled-check.sentinel
# Exact conversion quality: Limited

locals {
    all_secret_rotations = core::getresources("aws_secretsmanager_secret_rotation", {})
    rotation_secret_ids = {
        for rotation in local.all_secret_rotations :
        core::try(rotation.secret_id, "") => true
    }
}

resource_policy "aws_secretsmanager_secret" "secretsmanager_auto_rotation_enabled_check" {
    locals {
        secret_id = core::try(attrs.id, "")
        has_rotation = core::try(local.rotation_secret_ids[local.secret_id], false)
    }

    enforce {
        condition = local.has_rotation
        error_message = "Secrets Manager secrets should have a matching aws_secretsmanager_secret_rotation resource"
    }
}

# This policy requires resources of type `aws_secretsmanager_secret` should be configured for automatic rotation.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports

import "tfconfig/v2" as tfconfig
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps
import "strings"

# Constants

const = {
	"policy_name": "secretsmanager-auto-rotation-enabled-check",
	"message":     "Secrets Manager secrets should be configured for automatic rotation. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html#secretsmanager-1 for more details.",
	"resource_aws_secretsmanager_secret":          "aws_secretsmanager_secret",
	"resource_aws_secretsmanager_secret_rotation": "aws_secretsmanager_secret_rotation",
	"kms_master_key_id":                           "kms_master_key_id",
	"sqs_managed_sse_enabled":                     "sqs_managed_sse_enabled",
	"module_prefix":                               "module.",
}

# Functions

get_referenced_resource_address = func(res, attr) {
	references_list = maps.get(res, attr, [])
	if references_list.references is empty or references_list.references is not defined {
		return ""
	}
	referenced_address = references_list.references[1]
	if strings.has_prefix(res.address, const.module_prefix) {
		referenced_address = res.module_address + "." + referenced_address
	}
	return referenced_address
}

# Variables

secret_resources = tf.config(tfconfig.resources).type(const.resource_aws_secretsmanager_secret).resources
secret_rotation_complaint_resources = tf.config(tfconfig.resources).type(const.resource_aws_secretsmanager_secret_rotation).resources

secret_addresses = map secret_rotation_complaint_resources as _, res {
	get_referenced_resource_address(res, "config.secret_id")
}

violations = filter secret_resources as _, res {
	res.address not in secret_addresses
}

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs

print(report.generate_policy_report(summary))

# Rules

main = rule {
	violations is empty
}

Step Functions State Machine Logging Enabled

Source Sentinel Policy

step-functions-state-machine-logging-enabled.sentinel

Conversion Quality

Good

Why this is Good

This policy is still a single-resource planned-value check, but it relies on a nested block (logging_configuration) and an allowlist of valid levels. tfpolicy can express that clearly with core::try() and a small local allowlist.

Key translation notes

• Nested map access becomes direct block access through attrs.logging_configuration[0].level
• The allowed log levels carry over directly into the tfpolicy version

Limitations encountered

This relies on the provider exposing logging_configuration in the expected block/list shape. Otherwise, the enforcement intent maps cleanly.

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: MPL-2.0

# Converted from HashiCorp PCI DSS Sentinel example: step-functions-state-machine-logging-enabled.sentinel
# Conversion quality: Good

resource_policy "aws_sfn_state_machine" "step_functions_state_machine_logging_enabled" {
    locals {
        logging_configuration = core::try(attrs.logging_configuration, [])
        log_level = core::try(local.logging_configuration[0].level, "")
        allowed_levels = ["ALL", "ERROR", "FATAL"]
    }

    enforce {
        condition = core::contains(local.allowed_levels, local.log_level)
        error_message = "Step Functions state machines must set logging_configuration.level to ALL, ERROR, or FATAL"
    }
}

# This policy requires AWS Step Functions state machines to have logging configuration enabled with level set to "ALL", "ERROR", or "FATAL".

# Copyright IBM Corp. 2025, 2026
# SPDX-License-Identifier: BUSL-1.1

# Imports
import "tfplan/v2" as tfplan
import "tfresources" as tf
import "report" as report
import "collection" as collection
import "collection/maps" as maps

# Constants
const = {
	"policy_name":         "sfn-logging-enabled",
	"message":             "AWS Step Functions state machines must have logging enabled with level set to 'ALL', 'ERROR', or 'FATAL'. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/stepfunctions-controls.html#stepfunctions-1 for more details.",
	"resource_aws_sfn":    "aws_sfn_state_machine",
	"logging_config":      "logging_configuration",
	"required_log_levels": ["ALL", "ERROR", "FATAL"],
}

# Variables
resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_sfn).resources

violations = collection.reject(resources, func(res) {
	logging_config = maps.get(res, "values." + const.logging_config, null)

	if logging_config is null {
		return false
	}
	log_level = maps.get(logging_config[0], "level", null)
	if log_level is null {
		return false
	}

	return log_level in const.required_log_levels
})

summary = {
	"policy_name": const.policy_name,
	"violations": map violations as _, v {
		{
			"address":        v.address,
			"module_address": v.module_address,
			"message":        const.message,
		}
	},
}

# Outputs
print(report.generate_policy_report(summary))

# Rules
main = rule {
	violations is empty
}

name: tfpolicy-author
description: Expert agent for authoring Terraform Policies — from natural-language requirements or Sentinel source. Covers the full workflow write new policies, convert existing Sentinel policies, parameterize with inputs, structure cross-resource checks, apply operation scoping, and produce remediation-focused error messages.
license: MPL-2.0
metadata:
  copyright: Copyright IBM Corp. 2026
  version: "0.2.0"

tfpolicy-author

Description

Expert agent for writing Terraform Policies — from either a natural-language requirement or an existing Sentinel .sentinel source. Covers the full authoring and conversion workflow: translate requirements or Sentinel logic into resource_policy, module_policy, or provider_policy HCL with correct cross-resource patterns, operation scoping, core:: functions, parameterized inputs, and remediation-focused error messages.

Note: This skill supersedes sentinel-to-tfpolicy. All Sentinel conversion knowledge is now consolidated here to ensure consistent behaviour when generating policies from Sentinel sources.

Use When

• The user describes an enforcement rule and wants a .policy.hcl file ("block public RDS", "require encryption", "deny instance types outside an allowlist").
• The user has a Sentinel .sentinel file (or snippet) and wants the Terraform Policy equivalent.
• The user is migrating a Sentinel policy library to tfpolicy and needs per-policy assessment.
• The user is writing a new resource_policy, module_policy, or provider_policy block.
• The user is asking about tfpolicy language features — filter, locals, enforce, input, operations, prior_attrs, core::* functions, list comprehensions, version constraints, time/date functions.
• The user is asking how to structure a policy that depends on related resources via core::getresources() or core::getdatasource().
• The user is comparing Sentinel and tfpolicy capabilities ("can I express X in tfpolicy?").

Do not use this skill when:

• The user is writing or debugging a .policytest.hcl test file — use tfpolicy-test (tfpolicy-test.md).

Capabilities

1. Write Policies from User Intent

Turn natural-language requirements into resource_policy, module_policy, or provider_policy blocks with appropriate filters, locals, enforce blocks, and remediation-focused error messages.

2. Convert Sentinel Policies to Terraform Policy

Translate Sentinel constructs into tfpolicy equivalents, flag non-convertible patterns with practical alternatives, produce idiomatic .policy.hcl from existing Sentinel sources, and apply a quality label to each conversion.

3. Apply Operation Scoping Correctly

Use operations = ["create", "update", "delete"] and prior_attrs.<name> to scope policies to the right plan actions and read pre-change state when relevant.

4. Parameterize with input Blocks

Replace hardcoded allowlists, version constraints, and thresholds with input blocks so policy sets can override values per environment.

5. Structure Cross-Resource Checks Safely

Use core::getresources() at the top level for plan-time joins, with value-based filters when the filter is a known literal or existing ID. Use inline core::getresources() inside resource_policy for apply-time parent+child lookups, when the filter depends on the current resource's own attribute (e.g. {bucket = attrs.id}). Consult the decision table (line 232) to choose the correct pattern; both top-level and inline are first-class options for their respective scenarios. Understand when cross-references will be unresolved at plan time.

6. Surface Runtime Pitfalls Up Front

Steer the user away from documented runtime hazards — meta.address is undefined in resource_policy, core::try() defaults can silently mask non-compliant resources, sets must be converted to lists for indexing, multi-line boolean expressions break the parser, etc.

Knowledge Base

Policy Types

resource_policy "<resource_type>" "<policy_name>" { }
module_policy   "<module_pattern>" "<policy_name>" { }
provider_policy "<provider_pattern>" "<policy_name>" { }

Required policy.required_providers Block

Every .policy.hcl file containing resource or provider policies must declare a top-level policy { required_providers { ... } } block. tfpolicy validate uses this block to resolve provider schemas for schema-aware validation, and validation fails when the block is omitted.

Use the same top-level policy scaffold shown in the Core Structure and Worked Example sections; only the provider source/version values should vary by policy.

Rules and limitations:

• required_providers is mandatory for .policy.hcl validation.
• Validation is best effort for version ranges. When a range is declared, validation evaluates provider schemas at the lower and upper bounds of the range.
• Wildcard targets such as resource_policy "*" are not schema-validated because they may match multiple resource types.
• required_providers declares provider source and version constraints for validation. This is distinct from meta.version in provider_policy, which exposes the resolved provider version during policy evaluation.

Core Structure

policy {
  required_providers {
    # Declare provider source and version constraints for validation.
    # Use version ranges that cover the provider versions deployed in your infrastructure.
    # Example with AWS provider (adjust based on your environment):
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0.0, < 7.0.0"  # Covers AWS provider 5.x and 6.x
    }
    # Add other providers as needed (azurerm, google, etc.)
  }
}

resource_policy "aws_ebs_volume" "encryption_check" {
  # Optional: pre-filter resources before evaluation
  filter = attrs.encrypted != null

  # Optional: locals for readable logic
  locals {
    encrypted = core::try(attrs.encrypted, false)
  }

  # One or more enforce blocks
  enforce {
    condition     = local.encrypted == true
    error_message = "EBS volumes must have encryption enabled."
  }
}

Available Attribute Surfaces

Operation Scoping and prior_attrs

# Skip destroy
resource_policy "tfe_workspace" "require_tags" {
  operations = ["create", "update"]
  enforce {
    condition     = core::length(core::try(attrs.tag_names, [])) > 0
    error_message = "Workspace must have at least one tag."
  }
}

# Delete-gate
resource_policy "tfe_workspace" "deny_delete_without_tag" {
  operations = ["delete"]   # prior_attrs available when "create" not in operations
  locals {
    prior_tag_names = core::try(prior_attrs.tag_names, [])
  }
  enforce {
    condition     = core::contains(local.prior_tag_names, "delete")
    error_message = "Add 'delete' tag before destroying the workspace."
  }
}

Rules:

• operations = ["create", "update"] — fires on create/update, skips destroy.
• operations = ["delete"] — fires only on destroy; prior_attrs holds pre-change state.
• operations = ["update"] — fires only on updates; prior_attrs available.
• Default (no operations) = create and update (never destroy).
• prior_attrs is only accessible when "create" is NOT in operations.

input Blocks — Parameterization

input "allowed_instance_types" {
  type    = list(string)
  default = ["t3.micro", "t3.small", "t3.medium"]
}

resource_policy "aws_instance" "allowed_types" {
  enforce {
    condition     = core::contains(input.allowed_instance_types, attrs.instance_type)
    error_message = "Instance type '${attrs.instance_type}' is not in the allowed list."
  }
}

Policy sets can override input defaults without editing the policy file. Use input for: allowlists, blocklists, version constraints, numeric thresholds — values an operator may need to tune per environment.

Rule — input vs hardcoded locals:

• Use input {} only for operator-tunable values: allowlists, blocklists, thresholds, time windows. If a value varies per environment or policy set, it belongs in input.
• Use locals or inline literals for invariant enforcement constants — values that are part of the policy logic itself and should NOT be overridden (e.g. a fixed list of well-known dangerous ports defined by a security standard, a required protocol name).
• Do NOT promote fixed enforcement constants to input unless the requirement explicitly says they are configurable.

core:: Functions — Common Idioms

• Null safety: core::try(attrs.field, default) — single layer; don't nest. 🔴 MANDATORY: always use the two-step pattern below when the attribute may be explicitly null.

• Membership: core::contains(list, value) — for lists. For string substring use core::contains_substring.

• Strings: core::startswith, core::endswith, core::contains_substring, core::regex (throws on no match — wrap in core::try), core::split(separator, string) (use with core::parseint() for numeric decomposition — see verified-syntax.md Section 2 for full examples). ❌ Never use + for string concatenation — + is numeric addition only; using it with strings throws Error: Unsuitable value for left operand: a number is required. ✅ Use "${local.var}" string interpolation instead: e.g. "table/${local.table_name}" not "table/" + local.table_name.

• Aggregates: core::length(list_or_map). On tfpolicy 0.3.x+, use core::alltrue(list) and core::anytrue(list) for boolean collection checks; on tfpolicy 0.2.x, use filtered-count patterns instead. See verified-syntax.md for exact empty-list, unknown, and coercion behavior.

• Ranges: core::range(limit) → [0, 1, …, limit-1]; core::range(lower, upper) → [lower, lower+1, …, upper-1]; core::range(lower, upper, step) → step-incremented list from lower up to (but not including) upper. Works with hardcoded integer literals. ⚠️ With dynamic attrs.* integer values (e.g. attrs.from_port, attrs.to_port) core::range() silently returns an empty list in the policytest framework — prefer the count approach for port-range policies (see verified-syntax.md Mistake 23).

• Time: core::timestamp(), core::formatdate("EEEE", core::timestamp()) (weekday, UTC), core::parseint(core::formatdate("HH", core::timestamp()), 10) (hour, UTC).

• Semver: core::semverconstraint(version, "~> 4.67.0") — supports =, >=, <, ~>, range, !=. Always wrap in core::try(..., false) to handle non-semver or unparseable version strings gracefully. ⚠️ Prefer this over core::split + core::parseint for all version range checks converted from Sentinel string comparisons — manual integer parsing fails silently for non-numeric version suffixes and null/empty inputs.

  🔴 NEVER place core::semverconstraint directly in a filter = expression. Even with != null and != "" guards in the same expression, semverconstraint is evaluated regardless of short-circuit ordering in the filter context and throws a parse error when the version string is malformed (e.g. a non-semver string like "x.y") or null/empty. Always move it into locals and wrap with core::try(..., false):

  # ❌ Wrong — crashes when version string is non-semver, null, or empty:
  filter = core::try(attrs.version, null) != null &&
           core::try(attrs.version, "") != "" &&
           core::semverconstraint(core::try(attrs.version, "0.0"), "< 2.0")
  
  # ✅ Correct — filter guards null/empty only; semverconstraint lives in locals:
  filter = core::try(attrs.version, null) != null &&
           core::try(attrs.version, "") != ""
  locals {
    version      = core::try(attrs.version, "")
    # core::try wraps semverconstraint to safely handle non-semver strings → false
    is_old       = core::try(core::semverconstraint(local.version, "< 2.0"), false)
    # When version is old, enforce the required attribute; when version >= 2.0, always compliant
    is_compliant = !local.is_old || local.required_attr_set
  }

• Null safety — two-step pattern (MANDATORY for any attribute that may be explicitly null): core::try(attrs.field, default) triggers the fallback only when the attribute access throws an error (key absent). When an attribute is explicitly set to null, core::try returns null — not the default. This is a silent pitfall: core::length(null) crashes with Invalid value for "collection" parameter; null == false evaluates as null (not true), causing enforce to trigger unexpectedly.

  Always use the explicit two-step pattern:

  # Collection attribute (list/map) — safe pattern:
  field_raw = core::try(attrs.field, null)
  field     = local.field_raw != null ? local.field_raw : []
  # ✅ Safe to pass to: core::length(), core::contains(), for expressions
  
  # Scalar boolean attribute — safe pattern:
  flag_raw  = core::try(attrs.flag, null)
  flag      = local.flag_raw == null ? false : local.flag_raw
  # ✅ Safe to use in: condition = !local.flag, condition = local.flag == false

  For filter expressions that must exclude both null and empty-string values: filter = core::try(attrs.field, null) != null && core::try(attrs.field, "") != "". The two-step rule applies at every nesting level. When a scalar is accessed through a nested path (e.g. core::try(local.list[0].scalar_attr, default)), apply the same pattern: if the attribute may be null, use core::try(..., null) and normalize explicitly.

• JSON: core::jsondecode(string) — parses a JSON string into an object/list. core::jsonencode(value) — encodes a value as a JSON string. ❌ json::unmarshal does not exist — use core::jsondecode instead.

• Nested block attribute schema — object vs list: Terraform provider schemas define nested blocks as either a list of objects ([{ ... }]) or a single object ({ ... }). Always check the provider schema before accessing nested attributes:

  • List block (e.g. encryption_config = [{ provider = [{ key_arn = "..." }] }]): access via index attrs.encryption_config[0].provider[0].key_arn. Use core::try(attrs.field, []) and field[0].subattr.
  • Object block (e.g. redirect = { port = "443", protocol = "HTTPS" }): access directly attrs.redirect.port. Use core::try(attrs.redirect.port, "").
  • ❌ Never call core::length() on an object — core::length requires a list, map, or tuple. Calling core::length(attrs.redirect) when redirect is an object crashes with collection must be a list, a map or a tuple. To check presence of an object block, use core::try(attrs.redirect, null) != null instead.
  • ❌ Never iterate over an object block with a for expression. for r in core::try(attrs.block, []) — when attrs.block is an object, this iterates over the object's scalar values, not the object as an element. core::try(r.sub_attr, "") on a string silently returns "". Use direct attribute access instead: core::try(attrs.block.sub_attr, "").
  • When Sentinel mocks use redirect = { ... } (object), the TFPolicy test mock and policy must treat it as an object. When Sentinel mocks use redirect = [{ ... }] (list), use list indexing. Mismatching the shape causes either runtime crashes or silent wrong results.

IAM Policy Checks

When enforcing IAM content rules (e.g. "no admin *:* allowed", "no wildcard actions"), you MUST cover all 4 inline policy resource types — not just aws_iam_policy.

🔴 Always write 4 resource_policy blocks for IAM content enforcement:

Rule: A policy that only checks aws_iam_policy misses inline policies on roles/users/groups. An admin could bypass it by using aws_iam_role_policy instead of aws_iam_policy.

Note on aws_iam_policy_document: This resource type requires careful distinction between two different use cases:

• As a Terraform data block (the common case in real Terraform configurations) — data_policy does not exist in tfpolicy (Mistake 31). Do NOT write data_policy "aws_iam_policy_document". In this scenario, the policy document content is consumed by one of the 4 inline/managed policy resource types above, and enforcement should target those resource types.
• As a resource in .policytest.hcl mocks and when the Sentinel source reads it via tfstate/v2 — resource_policy "aws_iam_policy_document" is valid and directly targets the document's statement attribute (lowercase actions, not Action). When a Sentinel policy reads aws_iam_policy_document from tfstate, the correct TFPolicy conversion is resource_policy "aws_iam_policy_document" — do NOT substitute inline/managed policy resource types.

Decision rule: Check the Sentinel import statement. If the Sentinel uses tfstate/v2 to read aws_iam_policy_document resources, convert to resource_policy "aws_iam_policy_document". If the Sentinel reads the consuming resource (aws_iam_role_policy, etc.), target those 4 types instead.

# ✅ CORRECT — define the check logic once, repeat for all 4 resource types
# (Each resource_policy block is independent; locals are block-scoped)

resource_policy "aws_iam_policy" "no_admin_privileges" {
  locals {
    statements  = core::try(core::jsondecode(core::try(attrs.policy, "{}")).Statement, [])
    admin_stmts = [for s in local.statements : s if core::lower(core::try(s.Effect, "Allow")) == "allow" && core::contains(core::try(s.Action, []), "*") && core::contains(core::try(s.Resource, []), "*")]
  }
  enforce {
    condition     = core::length(local.admin_stmts) == 0
    error_message = "IAM policies must not grant full admin privileges (*:* on *)."
  }
}

resource_policy "aws_iam_role_policy" "no_admin_privileges" {
  locals {
    statements  = core::try(core::jsondecode(core::try(attrs.policy, "{}")).Statement, [])
    admin_stmts = [for s in local.statements : s if core::lower(core::try(s.Effect, "Allow")) == "allow" && core::contains(core::try(s.Action, []), "*") && core::contains(core::try(s.Resource, []), "*")]
  }
  enforce {
    condition     = core::length(local.admin_stmts) == 0
    error_message = "IAM role inline policies must not grant full admin privileges (*:* on *)."
  }
}

resource_policy "aws_iam_user_policy" "no_admin_privileges" {
  locals {
    statements  = core::try(core::jsondecode(core::try(attrs.policy, "{}")).Statement, [])
    admin_stmts = [for s in local.statements : s if core::lower(core::try(s.Effect, "Allow")) == "allow" && core::contains(core::try(s.Action, []), "*") && core::contains(core::try(s.Resource, []), "*")]
  }
  enforce {
    condition     = core::length(local.admin_stmts) == 0
    error_message = "IAM user inline policies must not grant full admin privileges (*:* on *)."
  }
}

resource_policy "aws_iam_group_policy" "no_admin_privileges" {
  locals {
    statements  = core::try(core::jsondecode(core::try(attrs.policy, "{}")).Statement, [])
    admin_stmts = [for s in local.statements : s if core::lower(core::try(s.Effect, "Allow")) == "allow" && core::contains(core::try(s.Action, []), "*") && core::contains(core::try(s.Resource, []), "*")]
  }
  enforce {
    condition     = core::length(local.admin_stmts) == 0
    error_message = "IAM group inline policies must not grant full admin privileges (*:* on *)."
  }
}

Cross-Resource Lookups

🛑 Self-check — run this BEFORE writing any resource_policy involving a companion/child resource:

"What is the enforcement goal?"

• "Every existing instance of <child_type> must have correct attributes" (e.g., "every aws_lb_listener must use HTTPS") → anchor resource_policy directly on the child type
• "Every parent must have at least one compliant child" (e.g., "every S3 bucket must have a public_access_block with all four flags set") → anchor resource_policy on the parent; a child-only policy silently misses parents with no child in the plan

Decision table — choose the correct pattern first:

⚠️ Critical: Never write a resource_policy "child_type" to enforce "every parent must have a child" — if the child resource is absent entirely, the policy never fires for that parent and the violation is silently missed.

🔴 Named companion resources — ALWAYS use the parent as resource_policy anchor when the goal is presence enforcement:

The following Terraform resource types are companion-only — a parent resource can exist in a plan without them. NEVER anchor a standalone resource_policy on these types when checking for their presence:

This pattern applies to all resource families, not just S3. Non-S3 examples: when checking "every VPC has a flow log" → anchor on aws_vpc with inline core::getresources("aws_flow_log", {vpc_id = attrs.id}); when checking "every LB has at least one compliant listener" → anchor on aws_lb with inline core::getresources("aws_lb_listener", {load_balancer_arn = attrs.arn}).

Why this matters: Even if the Sentinel source iterates over the companion type, TFPolicy must anchor on the parent. A Terraform plan can declare an aws_s3_bucket with NO companion resource — anchoring on the companion silently misses that bucket entirely.

⚠️ Parent-anchor means parent-ONLY: Once the decision table says "parent resource" is the anchor, generate resource_policy blocks exclusively on the parent type. Do NOT also generate standalone resource_policy blocks for companion types alongside the parent blocks. Adding companion blocks in parallel:

• still silently misses parents that have no companion
• double-reports violations

All enforcement logic — including every companion check — must live inside the parent resource_policy block, using inline or top-level lookups.

Plan-time pattern — use core::getresources() at the top level only when the filter value is a known constant (not derived from attrs.*). When the filter depends on the current resource's own attribute, use the inline pattern below instead. ❌ Top-level {} (empty filter) + for-loop or lookup map filtered by attrs.* inside resource_policy is the prohibited anti-pattern — see verified-syntax.md Mistake 13 for both variants.

⚠️ Exception — "companion absence is itself a violation": When the goal is to enforce that a companion resource exists AND has matching attributes (e.g. a parent resource must have a linked companion with a specific qualifying attribute set), the inline filter pattern produces false negatives: if the companion is absent or has a mismatching linking key, core::getresources() returns [], and !has_companion is true → a condition like !has_companion || check_attr == "VALUE" incorrectly passes. Use the top-level collect-then-filter pattern instead:

# Top-level: collect ALL companions globally, filter to those with the qualifying attribute,
# then check membership inside resource_policy.
locals {
  all_companions      = core::getresources("aws_companion_resource", {})
  # Filter to companions that have the qualifying attribute set (e.g. non-empty elb)
  qualifying_companions = [for c in local.all_companions : c
    if core::try(c.qualifying_attr, null) != null && core::try(c.qualifying_attr, "") != ""]
  # Collect the linking attribute values from qualifying companions only
  companion_names     = [for c in local.qualifying_companions : core::try(c.linking_attr, "")]
  # Use qualifying companions (not all) to decide whether to evaluate
  has_qualifying      = core::length(local.qualifying_companions) > 0
}

resource_policy "aws_parent_resource" "example" {
  # Only evaluate when qualifying companions exist in the plan
  filter = local.has_qualifying

  locals {
    parent_name   = core::try(attrs.name, "")
    is_linked     = core::length([for n in local.companion_names : n if n == local.parent_name]) > 0
    # 🔴 Condition must be POSITIVE: both linked AND check_attr correct
    # Do NOT use: !is_linked || check_attr == "EXPECTED"  ← this passes when companion absent
    is_compliant  = local.is_linked && core::try(attrs.check_attr, "") == "EXPECTED"
  }

  enforce {
    condition     = local.is_compliant
    error_message = "..."
  }
}

This pattern correctly detects:

• Companion absent entirely → has_qualifying = false → filter = false → parent skipped ✓
• Companion present but with no qualifying attribute → qualifying_companions = [] → has_qualifying = false → parent skipped ✓
• Companion with wrong linking_attr value → is_linked = false → is_compliant = false → violation ✓
• Companion with correct linking and correct check_attr → is_compliant = true → passes ✓

⚠️ Choose filter scope carefully: filter = local.has_qualifying (qualifying companions only) skips all parents when no qualifying companions exist — this matches a Sentinel that returns early when no qualifying companions are found. If the Sentinel does NOT skip when non-qualifying companions exist (e.g. it evaluates parents even when only ALB/NLB attachments are present), use filter = core::length(local.all_companions) > 0 instead. With this broader filter, unlinked parents (is_linked = false) are evaluated and correctly fail is_linked && check_attr == VALUE.

🔴 Condition polarity rule: When using the top-level collect-then-filter pattern, always use a positive condition (is_linked && check_attr == VALUE), not a negative condition (!is_linked || check_attr == VALUE). The negative form silently passes any parent that is not linked — which is the opposite of the intended enforcement. With the positive form: unlinked parent → is_linked = false → is_compliant = false → violation (correct). With the negative form: unlinked parent → !false || any = true → is_compliant = true → passes (incorrect).

Apply-time pattern — when the filter value is the current resource's own attribute (e.g. bucket = attrs.id, or event_bus_name = attrs.name), use an inline core::getresources() call with the direct filter inside resource_policy. The filter cannot resolve at plan time (the attribute value is unknown until apply), but fully resolves once the resource is provisioned. The linking attribute may reference attrs.id, attrs.arn, or attrs.name — check the child resource's Terraform Registry docs to determine which one.

S3 cross-resource note: Always use attrs.id (not attrs.bucket) when filtering S3 child resources such as aws_s3_bucket_public_access_block, aws_s3_bucket_acl, aws_s3_bucket_server_side_encryption_configuration, and aws_s3_bucket_policy. Terraform providers set the child resource's linking attribute (bucket) to the parent bucket's .id. Using attrs.id ensures the filter matches the actual value stored in the child resource's plan.

# NOTE: This policy contains a cross-resource reference that will not resolve during plan time,
# but the policy will run successfully during apply time.
resource_policy "aws_s3_bucket" "s3_block_public_access" {
  locals {
    public_access_block     = core::getresources("aws_s3_bucket_public_access_block", {
      bucket = attrs.id
    })
    block_public_acls       = core::try(local.public_access_block[0].block_public_acls, false)
    block_public_policy     = core::try(local.public_access_block[0].block_public_policy, false)
    ignore_public_acls      = core::try(local.public_access_block[0].ignore_public_acls, false)
    restrict_public_buckets = core::try(local.public_access_block[0].restrict_public_buckets, false)
  }

  enforce {
    condition     = local.block_public_acls && local.block_public_policy && local.ignore_public_acls && local.restrict_public_buckets
    error_message = "S3 bucket does not have all public access block settings enabled."
  }
}

Error Message Rules

• ✅ Static strings: "S3 buckets must enable versioning."
• ✅ Safe interpolation: "Instance type '${attrs.instance_type}' is not allowed."
• ❌ Never interpolate ${meta.address} — it is UNDEFINED in resource_policy and crashes at runtime. tfpolicy test will NOT catch this; only a real terraform plan will.
• Use error_message for all enforceable violations (condition can be false).
• Use info_message only in non-convertible stub blocks where condition = true and no real enforcement is possible. Never use info_message in a block that can actually fail a resource.

Comment Conventions — # LIMITATION: vs # NOTE:

These two markers have distinct meanings — do not interchange them:

• # LIMITATION: — tfpolicy cannot fully express or enforce the requirement. Part of the original Sentinel logic had to be omitted or approximated. Always accompanies a Simplify or Not convertible quality label.
  • Example: "LIMITATION: The bucket policy IAM document check is non-convertible — tfpolicy does not expose reference metadata."
• # NOTE: — The enforcement is complete but has a runtime caveat that does not reduce coverage.
  • Example: "NOTE: This policy contains a cross-resource reference that will not resolve during plan time, but will run successfully during apply time."

Output Structure Rules — Consistency-Critical

These rules eliminate the most common sources of non-deterministic output between runs:

Rule 1 — One resource_policy block per resource type. Multiple checks on the same resource type MUST be combined into a single resource_policy block using separate locals and multiple enforce blocks. Never split checks into two resource_policy blocks for the same type.

# ✅ Correct — two checks, one block
resource_policy "aws_ecs_task_definition" "secure_networking" {
  filter = core::try(attrs.network_mode, "") == "host"
  locals {
    containers           = core::try(core::jsondecode(attrs.container_definitions), [])
    non_privileged       = [for c in local.containers : c if core::try(c.privileged, false) != true]
    insecure_user        = [for c in local.containers : c if core::try(c.user, "") == "" || core::try(c.user, "") == "root"]
  }
  enforcement_level = "advisory"
  enforce {
    condition     = core::length(local.non_privileged) == core::length(local.containers)
    error_message = "ECS task definition containers must not run as privileged."
  }
  enforce {
    condition     = core::length(local.insecure_user) == 0
    error_message = "ECS task definition containers must define a non-root user."
  }
}

# ❌ Wrong — same resource type split across two blocks
resource_policy "aws_ecs_task_definition" "check_privileged" { ... }
resource_policy "aws_ecs_task_definition" "check_user" { ... }

Rule 2 — Non-convertible checks are comments, not stub blocks. When a specific check cannot be converted (reference metadata, etc.), document it as a # LIMITATION: comment inside the existing resource_policy block — do NOT create a separate resource_policy block of the same type as a stub. A dedicated stub block (with condition = true) is only appropriate when the entire policy has no convertible checks at all.

Rule 3 — Per-resource enforcement for all checks. Do NOT aggregate across all resources of a type at the plan level (e.g. "at least one trail in the whole plan is compliant = pass all"). Each resource_policy must evaluate each individual resource independently. tfpolicy's evaluation model is per-resource — plan-level aggregation via top-level core::getresources() to pass/fail based on a count across all resources is not idiomatic and produces non-deterministic results.

# ✅ Correct — each aws_cloudtrail resource evaluated independently
resource_policy "aws_cloudtrail" "s3_dataevents_enabled" {
  locals { ... }
  enforce {
    condition     = local.is_compliant
    error_message = "This CloudTrail trail must log S3 data events."
  }
}

# ❌ Wrong — plan-level aggregation ("at least one compliant trail")
locals {
  all_trails     = core::getresources("aws_cloudtrail", {})
  num_compliant  = core::length([for t in local.all_trails : t if ...])
  any_compliant  = local.num_compliant > 0
}
resource_policy "aws_cloudtrail" "s3_dataevents_enabled" {
  enforce {
    condition     = local.any_compliant  # Wrong: passes every trail if any one trail is compliant
    error_message = "..."
  }
}

Sentinel → Terraform Policy Conversion

Use this section when the input is an existing Sentinel .sentinel file. Follow Steps 1–5 below; apply the authoring guidance above when generating the policy HCL.

Sentinel → Terraform Policy construct mapping

When converting Sentinel summary {} output or print() statements, do not reproduce address-listing behavior. Terraform Policy diagnostics already identify the failing resource — prefer remediation-focused messages instead.

Sentinel features that ARE convertible

1. Time-based rules — core::timestamp() + core::formatdate() + core::parseint() cover Sentinel's time import. All values are UTC; document that assumption in policy comments.
2. param blocks — direct equivalent: input blocks with type and default.
3. rc.change.before for update/delete — prior_attrs is available when operations does NOT include "create".
4. Integer range checks — Sentinel policies that check whether all ports within [from_port, to_port] are authorized CAN be converted. Use the count approach: filter authorized_ports to those within the range and compare the count to to_port - from_port + 1. Do not use core::range() with dynamic attrs.* values. See verified-syntax.md Mistake 23.
5. tfconfig/v2 reference count — each resource reference is stored twice in .references (once as resource.name, once as resource.name.id). When simplifying a reference-count check to a direct core::length(attrs.attribute) check, halve the threshold: references > 2 → core::length(attrs.attribute) >= 2.

Plan-Time vs Apply-Time Policies

Terraform Policy can enforce controls at plan time (before terraform apply) or apply time (during terraform apply). Most policies are plan-time, but cross-resource lookups that depend on newly-created resource IDs only fully resolve at apply time.

When a Sentinel policy uses cross-resource references with a value-based filter from a newly-created resource:

• Generate the policy using an inline core::getresources() call with the direct filter inside resource_policy.
• Add this note in the conversion report (not a limitation label): "This policy contains a cross-resource reference that will not resolve during plan time, but the policy will run successfully during apply time."
• Do not label this as Simplify or Not convertible — it is a valid Good conversion.

For cross-resource patterns, apply the registry check (Steps A and B) described in "Cross-Resource Lookups" above. The registry check fully determines the policy structure, regardless of whether the Sentinel's violations iterated the parent or the child type. Dependent child resource types must never have a standalone resource_policy block.

Cannot Convert (Explain the Alternative)

1. Mocking/testing infrastructure (import "tfconfig-functions") — tfpolicy uses .policytest.hcl. See the tfpolicy-test skill (tfpolicy-test.md).
2. Custom Sentinel imports — limited plugin support; use HTTP plugins or native functions if available.
3. Sentinel simulator / built-in test framework — replace with .policytest.hcl test files.
4. Cross-workspace data access — tfpolicy evaluates a single plan. Use workspace tags (meta.tfe_workspace.tags) or external plugins.
5. print() / debug statements — no debug output mechanism; rely on concise error_message / info_message text only when it adds remediation context.
6. Stateful logic across evaluations — policies are stateless; use external systems via plugins if state is required.
7. rc.change.before outside delete/update — for first-time creates there is no pre-state.
8. Cross-resource reference navigation via reference metadata (res.config.attribute["references"], res.config.to) — tfpolicy does not expose which Terraform resource a value points to. When the Sentinel policy uses the resolved value of an attribute (not the reference path itself), convert using core::getresources() with a value-based filter — see "Plan-Time vs Apply-Time Policies" above.
9. Data source content inspection by address — core::getdatasource() requires filter attributes and cannot query by Terraform address.
10. Complex resource-graph traversal via reference metadata — cannot traverse the Terraform resource graph by reference (e.g. "find all subnets that reference this VPC"). Only resolved attribute values are available. If the Sentinel policy traverses by resolved attribute value (e.g. bucket = attrs.id), convert using core::getresources() with a value-based filter and mark as an apply-time policy — see "Plan-Time vs Apply-Time Policies" above.

⚠️ Partial reference dependence — do not skip the whole policy. Items 8 and 10 apply to the specific check that uses reference metadata, not the entire policy. If only some checks in a Sentinel policy rely on res.config.attribute["references"] or graph traversal, convert the remaining checks as normal, apply the Simplify label to the overall policy, and document each skipped check in the report with: "This check was omitted — tfpolicy does not expose reference metadata (res.config.attribute["references"])." Only label the entire policy as Not convertible if its core enforcement logic is wholly dependent on reference metadata with no convertible remainder.

❌ Do not approximate reference-metadata checks with cross-resource JSON value matching. A common workaround is to retrieve all instances of a related resource via core::getresources() and compare their serialized attribute values (e.g. attrs.policy == doc.json) as a proxy for "this resource references that data source." This is not a faithful conversion — it produces false negatives when the referenced resource is already deployed and absent from the current plan, and enforces a different semantic (value equality) than the original (structural reference). When the only check IS reference metadata, generate a stub policy instead:

# <policy_name> — Non-Convertible (Reference Metadata)
resource_policy "<resource_type>" "<policy_name>_stub" {
  enforce {
    condition     = true
    info_message  = "Automated enforcement not available: this policy requires reference metadata inspection which tfpolicy does not support. Manual compliance review required."
  }
}

⚠️ Partial exception — direct content inspection via the parent bucket. The cross-resource approximation prohibition applies to comparing JSON across resources (e.g. fetching all aws_iam_policy_document outputs and matching against a bucket policy). It does not prohibit inspecting a bucket's own policy content. When the Sentinel reference-metadata check is really enforcing content (e.g. "the bucket policy must not grant public read access"), convert it by anchoring on resource_policy "aws_s3_bucket", fetching the child aws_s3_bucket_policy via core::getresources("aws_s3_bucket_policy", { bucket = attrs.id }), and inspecting its policy attribute via core::jsondecode() inside the parent block. This follows the standard dependent-child pattern — aws_s3_bucket_policy always requires a parent bucket. Label the overall policy Simplify (because the reference-path check is omitted) and add a # NOTE: that the content-based check achieves a similar security outcome.

# ✅ Content-based alternative to reference-metadata check on bucket policies
# NOTE: This policy contains a cross-resource reference that will not resolve during plan time,
# but the policy will run successfully during apply time.
resource_policy "aws_s3_bucket" "no_public_read_policy" {
  locals {
    bucket_policy       = core::getresources("aws_s3_bucket_policy", { bucket = attrs.id })
    policy_doc          = core::try(core::jsondecode(core::try(local.bucket_policy[0].policy, "{}")), { Statement = [] })
    statements_enriched = [for s in core::try(local.policy_doc.Statement, []) : { effect = core::lower(core::try(s.Effect, "Allow")), action = core::try(s.Action, []), principal_str = core::try(s.Principal, ""), principal_aws = core::try(core::try(s.Principal, {}).AWS, "") }]
    public_read_stmts   = [for s in local.statements_enriched : s if s.effect == "allow" && (core::contains(s.action, "s3:GetObject") || core::contains(s.action, "s3:*") || core::contains(s.action, "*")) && (s.principal_str == "*" || s.principal_aws == "*")]
  }
  enforce {
    condition     = core::length(local.public_read_stmts) == 0
    error_message = "S3 bucket policy must not grant public read access (Principal: * with s3:GetObject or s3:*)."
  }
}

Conversion quality labels

• Perfect — Same enforcement intent and behavior expressed directly in tfpolicy with no known semantic gap.
• Good — Preserves the important enforcement outcome using idiomatic tfpolicy structure (not a one-to-one translation).
• Simplify — Only part of the original Sentinel behavior can be reproduced; document the missing checks explicitly.
• Not convertible — tfpolicy lacks the runtime data or language features required for a safe translation.

Conversion Strategy

Steps to Convert a Sentinel Policy

Step 1 — Parse the Sentinel Structure

Identify imports (tfplan, tfconfig, tfstate, custom), filter logic and resource selection, main and sub-rules, and enforcement level (advisory vs mandatory). Ask: What resources are being checked? Which attributes are validated? Does the policy depend on before/after diff? Are there cross-resource dependencies? Are data sources inspected? Does it rely on reference metadata or graph traversal?

Identify the enforcement target and the parent type: For any policy involving cross-resource dependencies, first perform the registry check (Steps A and B in "Cross-Resource Lookups" above) to identify which resource types are dependent children and which are parent types. Then use the Sentinel's violations expression to confirm the parent type — this is the type your resource_policy targets. Write resource_policy on the parent type. Every dependent child type is accessed exclusively via core::getresources() inside that parent block; all conditions on child resources are evaluated there, and all violations are reported on the parent. Do not write a standalone resource_policy on any resource type that the registry identifies as a dependent child — this rule holds regardless of whether the Sentinel's violations iterated the child or the parent, and regardless of whether the check is about a missing child or a misconfigured one.

Cross-resource policies — use the Terraform Registry to identify the parent, linking attribute, and filter value. For any child resource type involved in a cross-resource lookup, fetch its documentation at https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/main/website/docs/r/{resource_name_without_aws_prefix}.html.markdown. Look for a (Required) argument referencing a parent resource in "Argument Reference" and confirm with the usage examples (.id vs .arn). The required argument name is the linking attribute; use the corresponding attrs.id or attrs.arn in the core::getresources() filter. This applies to all resource families — not just S3.

Do not over-constrain the enforcement condition beyond the Sentinel intent. When the Sentinel checks "at least one item in a collection satisfies condition X", the correct tfpolicy translation is core::length([for item in local.items : item if <condition>]) > 0. Do NOT translate this to "every item must satisfy X" (i.e. core::length([for item in local.items : item if !<condition>]) == 0) unless the Sentinel explicitly enforces ALL items. Over-constraining the condition creates false violations for valid configurations that the Sentinel would pass.

Distinguish enforcement intent from Sentinel implementation detail. Sentinel code often accesses a collection element by index (e.g. origins[0]) as a traversal shortcut rather than an intentional "only check the first item" rule. Before encoding an index access as a scope restriction, ask:

• Is the indexed access repeated for all resources in a filter loop? (If so, it is a loop artifact, not a one-item intent.)
• Does the policy name or comment indicate intent that applies to "all" items?
• Would checking only the first item leave a real security gap?
• Is this collection a structurally singleton block in the provider schema (e.g. max_items = 1) — in which case [0] is intentional?

When the answer to any of the first three questions is "yes" and the fourth is "no", convert the check to iterate all items in the collection, not just [0]. Document the interpretation in the requirements as: "Sentinel source accesses collection[0]; interpreted as checking all items to preserve full enforcement intent."

Step 2 — Assess Convertibility

Check for non-convertible patterns above. Document what cannot be converted and assign a quality label.

Step 3 — Map to tfpolicy Constructs

Use the mapping table above. In practice, focus on (in order): matching resource scope, translating attribute access and null handling, replacing collection helpers with list comprehensions, and splitting compound logic into locals + multiple enforce blocks.

Step 4 — Generate the policy

Follow the authoring guidance in the Knowledge Base sections above. Apply the cross-resource decision table and companion-anchor rules.

Error-message rules:

• ✅ Static strings, or safe ${attrs.fieldname} interpolation.
• ❌ Never interpolate ${meta.address} — it is UNDEFINED in resource_policy and throws Error: Unsupported attribute at runtime for every evaluated resource. tfpolicy test will not catch this; only a real terraform plan --policies= run will.

Step 5 — Document the Conversion

Include the quality label, test success rate (if tests written), any limitations or simplifications made, behavioral differences from Sentinel, and references to related documentation.

• tfpolicy-author.md (tfpolicy-author.md) — guided first-policy walkthrough.
• tfpolicy-author.md (tfpolicy-author.md) — reusable patterns (attribute checks, allowlists, cross-resource enforcement, etc.).
• verified-syntax.md (verified-syntax.md) — verified syntax tables, runtime limitations, common-mistake corrections. Source of truth — defer to this file when this SKILL.md disagrees.

Usage Instructions — Write a New Policy from User Intent

Step 1 — Clarify requirements

• Which resources / modules / providers to target.
• The specific condition to enforce.
• Whether create, update, and/or destroy should be in scope (operations).
• Whether any value should be tunable per policy set (→ input block).
• The desired error message and whether attrs.* interpolation is helpful.

Step 2 — Design the structure

• Choose the policy type (resource / module / provider).
• Decide whether a wildcard label ("*") is appropriate.
• Plan the filter for performance and to exclude resources where the attribute is meaningfully absent. Two cases:
  • Attribute absent = resource out of scope (e.g. no acl block set at all → resource doesn't configure ACLs → skip it): use filter = core::try(attrs.field, null) != null.
  • Attribute absent = AWS provider default applies (e.g. encrypted absent → AWS defaults to false → resource is still in scope and may violate the policy): do not filter on null. Use core::try(attrs.field, <aws_provider_default>) in the condition instead so absent resources are evaluated against the effective default.
• Move complex predicates into locals for readability.

Step 3 — Generate the policy

• Start .policy.hcl files containing resource or provider policies with a top-level policy { required_providers { ... } } block.
• Use provider sources and version constraints that match the resource types referenced by the policy.
• Run tfpolicy validate after authoring to confirm the policy parses and the referenced provider schemas can be resolved.
• See Required policy.required_providers Block (#required-policyrequired_providers-block) for validation limitations such as version-range best-effort checks and wildcard-target behavior.
• Wrap optional attributes in core::try().
• Keep each boolean expression on a single line.
• Use multiple enforce blocks when you want independent diagnostics.
• Never interpolate ${meta.address} in error_message.

Step 4 — Document the policy

• Header comment with description, resources checked, and any compliance reference.
• Note operation scope and any parameterization.

Worked Example

User request: "Ensure all S3 buckets have versioning enabled."

Include the top-level policy { required_providers { ... } } block shown in Core Structure (#core-structure).

# Ensure S3 Bucket Versioning is Enabled
#
# Enforces that all AWS S3 buckets have versioning enabled to protect
# against accidental deletion and enable recovery.
#
# Resources checked:
# - aws_s3_bucket with inline versioning configuration
# - aws_s3_bucket_versioning (standalone resource pattern)

resource_policy "aws_s3_bucket" "versioning_enabled" {
  filter = attrs.versioning != null

  locals {
    versioning_enabled = core::try(attrs.versioning[0].enabled, false)
  }

  enforce {
    condition     = local.versioning_enabled == true
    error_message = "S3 buckets must set versioning.enabled = true to protect against accidental deletion."
  }
}

resource_policy "aws_s3_bucket_versioning" "versioning_enabled" {
  locals {
    versioning_status = core::try(attrs.versioning_configuration[0].status, "Disabled")
  }

  enforce {
    condition     = local.versioning_status == "Enabled"
    error_message = "S3 bucket versioning resources must have status 'Enabled'. Current status: '${local.versioning_status}'."
  }
}

Best Practices

Policy Writing

1. Use descriptive policy names.
2. Add a comprehensive header comment with description, resources checked, and compliance references.
3. Always use core::try() for optional attributes.
4. Break down complex logic with locals.
5. Provide actionable, remediation-focused error messages.
6. Cover all variations of a resource family (e.g. AWS security groups: aws_security_group, aws_security_group_rule, aws_vpc_security_group_ingress_rule, aws_default_security_group).
7. Use filter to skip resources that don't apply (saves work and avoids false positives).
8. Cache core::getresources() results in top-level locals when the filter is a known literal or an existing resource ID — this avoids O(N) overhead per resource. Exception: when the filter depends on the current resource's own attribute (e.g. {bucket = attrs.id}, {event_bus_name = attrs.name}), the call cannot be pre-computed at top level because attrs is only available inside resource_policy — use the inline pattern instead (see item 15). ❌ Do NOT work around this by fetching all child resources at the top level with {} and building a lookup map — that is the same anti-pattern restructured.
9. Avoid core::getdatasource() inside resource_policy — it calls provider APIs.
10. Build lookup maps once for O(1) matching when iterating many resources.
11. Keep each boolean expression on a single line (HCL parser limitation in beta).
12. Use clear variable names (scanning_config, not sc).
13. Convert sets to lists before indexing: [for item in set : item][0].
14. Don't use core::try() defaults to mask missing values that should fail the policy — use filter instead.
15. For cross-resource lookups where the filter value is the current resource's own attribute: use an inline core::getresources() with the direct filter inside resource_policy. To find the correct linking attribute name and filter value, fetch the child resource's Terraform Registry documentation at https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/main/website/docs/r/{resource_name_without_aws_prefix}.html.markdown and look for the (Required) or (Optional) argument that references the parent resource. Check whether the usage examples assign it .id, .arn, or .name — use attrs.id, attrs.arn, or attrs.name accordingly. ⚠️ Some linking attributes are (Optional) in the schema (e.g. event_bus_name on aws_cloudwatch_event_bus_policy defaults to the default bus) but still represent a parent-child link — treat them the same way. Always add this comment in the policy: "This policy contains a cross-resource reference that will not resolve during plan time, but the policy will run successfully during apply time." Do not use a top-level cache + for-loop for this pattern.
16. Cross-resource enforcement — registry check determines the structure unconditionally:
    • First, verify every resource type via the Terraform Registry. For any resource type involved in a cross-resource check, fetch https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/main/website/docs/r/{resource_name_without_aws_prefix}.html.markdown. A resource is a dependent child if it has a (Required) argument whose description or usage examples reference another AWS resource by .id, .arn, or .name. The argument name is the linking attribute; the assignment in examples tells you whether to use attrs.id, attrs.arn, or attrs.name. The resource that the linking attribute points to is the parent type.
    • When the enforcement goal is to ensure every parent has a compliant child, the dependent child must NEVER have a standalone resource_policy block. Write the resource_policy block on the parent type. Fetch the dependent child inside the parent block via core::getresources("<child_type>", {<linking_attr> = attrs.id_or_arn_or_name}). Evaluate all attribute checks on those lookup results. Report all violations on the parent. When the goal is only to check every existing child's own attributes, a standalone resource_policy on the child type is valid — see Self-check above.
    • Concrete examples: aws_s3_bucket_public_access_block, aws_s3_bucket_policy, aws_s3_bucket_acl (all require bucket) → never standalone for any enforcement goal; always fetched inside resource_policy "aws_s3_bucket". aws_lb_listener → standalone resource_policy "aws_lb_listener" is valid when checking every listener's own attributes (e.g., protocol, ssl_policy); use resource_policy "aws_lb" with inline lookup only when the goal is "every LB must have at least one compliant listener".
    • Always add this comment when using this pattern: "This policy contains a cross-resource reference that will not resolve during plan time, but the policy will run successfully during apply time."

Communication

1. Ask clarifying questions; don't assume requirements.
2. Show sample passing and failing resources alongside the policy.
3. Explain enforcement-level trade-offs.
4. Offer simplifications when an exact rule isn't expressible.

See Also

• tfpolicy-test (tfpolicy-test.md) — write .policytest.hcl files to validate the policies authored here.
• ../../examples/README.md (../examples/README.md) — side-by-side Sentinel + .policy.hcl examples with quality labels and per-example READMEs.
• verified-syntax.md (verified-syntax.md) — shared source-of-truth syntax reference.

Purpose: Quick reference for AI agents to start writing Terraform Policy (tfpolicy) Status: All behaviors verified during private beta (2026-02-19) Compatible with: Any AI system capable of reading markdown and generating HCL code

Quick Start for AI Agents

When a user asks you to write a Terraform Policy:

1. Identify the policy type: resource_policy, module_policy, or provider_policy
2. Use the correct structure: filter (optional), locals (optional), enforce (required)
3. Remember: ALL built-in functions need core:: prefix
4. For versions: Always use core::semverconstraint(), never direct comparison
5. Validate: Check examples in this guide for patterns

Table of Contents

1. Critical Rules (#critical-rules)
2. Policy Structure (#policy-structure)
3. Policy Types (#policy-types)
4. Core Functions Reference (#core-functions-reference)
5. Semantic Versioning (#semantic-versioning)

See Also:

• Common Patterns (tfpolicy-author.md) - Common policy patterns and examples
• tfpolicy-author (tfpolicy-author.md) - Complete authoring reference for this sub-skill

Critical Rules

✅ Rule 1: ALL Functions Need core:: Prefix

ALWAYS use core:: prefix for built-in Terraform functions

# ✅ CORRECT
filter = core::try(attrs.encrypted, false) == true
is_valid = core::length([for b in local.checks : b if b]) > 0
message = "Allowed: ${core::join(", ", local.versions)}"

# ❌ WRONG - Will fail with "Unknown function" error
filter = try(attrs.encrypted, false) == true  # Missing core:: prefix
# ❌ WRONG - missing core:: prefix (tfpolicy 0.3.0+ does have core::anytrue, but bare anytrue() is never valid)
# is_valid = anytrue(local.checks)
# ✅ CORRECT on tfpolicy 0.3.0+; on < 0.3.0 use core::length([for b in local.checks : b if b]) > 0 instead
# is_valid = core::anytrue(local.checks)

✅ Rule 2: Use Semantic Versioning for ALL Version Comparisons

NEVER use direct comparison operators for versions

# ✅ CORRECT
condition = core::semverconstraint(meta.version, ">= 4.0.0, < 5.0.0")

# ❌ WRONG - Direct comparison doesn't work properly
condition = meta.version >= 4.0 && meta.version < 5.0

✅ Rule 3: ALL Policy Types Support locals and filter

Don't avoid using locals or filter - they work in all policy types

# ✅ All three policy types support this structure
resource_policy "aws_s3_bucket" "example" {
    filter = <condition>     # ✅ Supported
    locals { ... }           # ✅ Supported
    enforce { ... }          # ✅ Required
}

module_policy "example" "check" {
    filter = <condition>     # ✅ Supported
    locals { ... }           # ✅ Supported
    enforce { ... }          # ✅ Required
}

provider_policy "aws" "check" {
    filter = <condition>     # ✅ Supported
    locals { ... }           # ✅ Supported
    enforce { ... }          # ✅ Required
}

Note: Language servers during private beta may show false errors for locals in provider_policy. These are safe to ignore.

Policy Structure

Basic Template

<policy_type> "<target>" "<policy_name>" {
    # Optional: Pre-filter resources/modules/providers
    filter = <boolean_expression>

    # Optional: Local variables for complex logic
    locals {
        variable_name = <expression>
    }

    # Required: One or more enforcement rules
    enforce {
        condition = <boolean_expression>
        error_message = "<user-facing message>"
    }

    # Optional: Additional enforce blocks
    enforce {
        condition = <another_condition>
        error_message = "<another message>"
    }
}

Execution Flow

1. filter - Applied first, determines which resources/modules/providers to evaluate
2. locals - Computed once per filtered item
3. enforce - Each block evaluated; all must pass for policy to pass

Performance Best Practices

Critical for large configurations — choose the pattern based on what the filter depends on:

1. Top-level core::getresources() only when the filter is a known literal/constant

   • Use when the filter value is a hardcoded string, a fixed ID, or another stable literal — not derived from attrs.*
   • Executes once for the entire policy evaluation; result is reused by every resource_policy block
   • ❌ Do not use a top-level empty-filter call ({}) and then filter by attrs.* inside resource_policy — that is the prohibited anti-pattern (O(N²) with silent correctness bugs)

   locals {
       # OK — filter is a known literal, cached once for all resources
       all_buckets = core::getresources("aws_s3_bucket", {})
   }
   
   resource_policy "aws_s3_bucket" "example" {
       locals {
           bucket_count = core::length(local.all_buckets)  # Reuse cached value
       }
   }

2. Inline core::getresources() inside resource_policy when the filter depends on the resource's own attribute

   • Use when "every parent must have at least one compliant child" and the linking key is attrs.id, attrs.arn, or attrs.name
   • The filter value is unknown at plan time (it's the current resource's own attribute), so a top-level cache is impossible
   • Executes once per evaluated resource (apply-time); the lookup fully resolves once the resource is provisioned
   • This is not a performance compromise — it is the correct and required pattern for parent+child presence enforcement

   # NOTE: This policy contains a cross-resource reference that will not resolve during
   # plan time, but the policy will run successfully during apply time.
   resource_policy "aws_s3_bucket" "s3_block_public_access" {
       locals {
           public_access_block = core::getresources("aws_s3_bucket_public_access_block", {
               bucket = attrs.id   # filter depends on current resource — must be inline
           })
       }
       enforce {
           condition     = core::length(local.public_access_block) > 0
           error_message = "S3 bucket must have a public access block resource."
       }
   }

3. Use filter to reduce evaluation scope

   • Skip resources that don't need checking
   • Significantly improves performance