diff --git a/docs/user_docs/guides/working-with-terraform/3-validation.md b/docs/user_docs/guides/working-with-terraform/3-validation.md index 6158b164..69e04942 100644 --- a/docs/user_docs/guides/working-with-terraform/3-validation.md +++ b/docs/user_docs/guides/working-with-terraform/3-validation.md @@ -420,11 +420,18 @@ schema TFPlan: schema AcceptableChange: # Omit other attributes [...str]: any + $type: str + name: str + change: Change check: # Reject AWS autoscaling group Resource delete action all action in change.actions { action not in ["delete"] } if type == "aws_autoscaling_group", "Disable AWS autoscaling group resource delete action for the resource ${type} ${name}" + +schema Change: + [...str]: any + actions: [str] ``` This policy file checks that no AWS Auto Scaling groups are being deleted - even if that deletion is part of a delete-and-recreate operation. @@ -450,11 +457,18 @@ schema TFPlan: schema AcceptableChange: # Omit other attributes [...str]: any + $type: str + name: str + change: Change check: # Reject AWS autoscaling group Resource delete action all action in change.actions { - action not in ["create"] + action not in ["create"] # Use create to mock a check failure. } if type == "aws_autoscaling_group", "Disable AWS autoscaling group resource create action for the resource ${type} ${name}" + +schema Change: + [...str]: any + actions: [str] ``` Run the command diff --git a/examples/terraform/validation/main.k b/examples/terraform/validation/main.k index 452d3073..982a4efc 100644 --- a/examples/terraform/validation/main.k +++ b/examples/terraform/validation/main.k @@ -6,8 +6,15 @@ schema TFPlan: schema AcceptableChange: # Omit other attributes [...str]: any + $type: str + name: str + change: Change check: # Reject AWS autoscaling group Resource delete action all action in change.actions { action not in ["delete"] } if type == "aws_autoscaling_group", "Disable AWS autoscaling group resource delete action for the resource ${type} ${name}" + +schema Change: + [...str]: any + actions: [str] diff --git a/examples/terraform/validation/main.policy.failure.k b/examples/terraform/validation/main.policy.failure.k index ee49adef..6d3ed8b9 100644 --- a/examples/terraform/validation/main.policy.failure.k +++ b/examples/terraform/validation/main.policy.failure.k @@ -6,8 +6,15 @@ schema TFPlan: schema AcceptableChange: # Omit other attributes [...str]: any + $type: str + name: str + change: Change check: # Reject AWS autoscaling group Resource delete action all action in change.actions { action not in ["create"] # Use create to mock a check failure. } if type == "aws_autoscaling_group", "Disable AWS autoscaling group resource create action for the resource ${type} ${name}" + +schema Change: + [...str]: any + actions: [str] diff --git a/versioned_docs/version-0.9/user_docs/guides/working-with-terraform/3-validation.md b/versioned_docs/version-0.9/user_docs/guides/working-with-terraform/3-validation.md index 6158b164..69e04942 100644 --- a/versioned_docs/version-0.9/user_docs/guides/working-with-terraform/3-validation.md +++ b/versioned_docs/version-0.9/user_docs/guides/working-with-terraform/3-validation.md @@ -420,11 +420,18 @@ schema TFPlan: schema AcceptableChange: # Omit other attributes [...str]: any + $type: str + name: str + change: Change check: # Reject AWS autoscaling group Resource delete action all action in change.actions { action not in ["delete"] } if type == "aws_autoscaling_group", "Disable AWS autoscaling group resource delete action for the resource ${type} ${name}" + +schema Change: + [...str]: any + actions: [str] ``` This policy file checks that no AWS Auto Scaling groups are being deleted - even if that deletion is part of a delete-and-recreate operation. @@ -450,11 +457,18 @@ schema TFPlan: schema AcceptableChange: # Omit other attributes [...str]: any + $type: str + name: str + change: Change check: # Reject AWS autoscaling group Resource delete action all action in change.actions { - action not in ["create"] + action not in ["create"] # Use create to mock a check failure. } if type == "aws_autoscaling_group", "Disable AWS autoscaling group resource create action for the resource ${type} ${name}" + +schema Change: + [...str]: any + actions: [str] ``` Run the command