Policy as Code for Terraform

Learn how to create and enforce OPA policies on Terraform Plan, Terraform Plan Cost, and Terraform State.

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

Harness supports three Terraform-related entity types for policy evaluation. Each entity type has its own set of evaluation events, letting you enforce governance at different stages of your Terraform workflow.

Entity type	Evaluation event	When it runs
Terraform Plan	After Terraform Plan	After a Terraform Plan step completes in a pipeline
Terraform Plan Cost	After Terraform Plan	After a Terraform Plan step completes (evaluates the cost estimate)
Terraform State	After Terraform Plan / After Terraform Apply	After a Terraform Plan or Terraform Apply step completes

Go to Harness Governance Quickstart to set up governance before you create these policies.

Prerequisites

Complete these steps before you create a policy for Terraform entities.

• Harness Governance Overview

• Harness Governance Quickstart

• Policies use the OPA authoring language Rego. Go to OPA Policy Authoring to learn Rego syntax.

Sample policies in the library

Harness ships four built-in sample policies for Terraform entities. You can find them in the Library panel by searching for "terraform":

Terraform sample policies in the Library panel

Sample policy	Entity type	Description
Terraform Plan – EC2	Terraform Plan	Ensures the Terraform plan meets required EC2 criteria
Terraform State – EC2	Terraform State	Ensures the Terraform state meets required EC2 criteria
Terraform Plan Cost – Cost Estimate Increased	Terraform Plan Cost	Ensures cost estimate has not increased more than 10% compared to the last plan
Terraform Plan Cost – Total Cost Estimate	Terraform Plan Cost	Ensures the total cost does not exceed a specified amount

Terraform plan

Overview

A Terraform Plan policy evaluates the planned infrastructure changes before they are applied. Use this to enforce rules on what resources can be created, modified, or destroyed.

The policy is evaluated on the event:

• After Terraform Plan: evaluated after a Terraform Plan step completes in a pipeline.

Terraform Plan policy set, entity type and event

Step 1: Add a policy

Create the Rego policy that evaluates Terraform Plan data.

1. In Harness, go to Account Settings → Policies → New Policy.

2. Enter a Name for your policy and click Apply.

3. Add your Rego policy in the editor. You can use a sample from the Library (search "Terraform Plan") or write your own.

   Below is an example that blocks plans creating EC2 instances of a disallowed type:

package terraform_plan

deny[msg] {
  resource := input.plan.resource_changes[_]
  resource.type == "aws_instance"
  resource.change.after.instance_type == "t2.micro"
  msg := sprintf("Resource '%s' uses instance type 't2.micro' which is not allowed. Use 't3.micro' or larger.", [resource.address])
}

1. Click Save.

Step 2: Add the policy to a policy set

Add the policy to a policy set scoped to the Terraform Plan entity type.

1. Go to Policies → Policy Sets → New Policy Set.

2. Enter a Name and optional Description.

3. In Entity type, select Terraform Plan.

4. In On what event should the Policy Set be evaluated, select After Terraform Plan.

5. Click Continue.

6. In Policy evaluation criteria, click Add Policy and select your policy.

7. Select the severity:

   • Warn & continue: a warning is displayed but the pipeline continues.

   • Error and exit: the pipeline fails if the policy is not met.

8. Click Apply, then click Finish.

Terraform plan cost

Overview

A Terraform Plan Cost policy evaluates the estimated cost of planned infrastructure changes. Use this to set cost guardrails and prevent unexpected spending.

The policy is evaluated on the event:

• After Terraform Plan: evaluated after a Terraform Plan step completes, using the cost estimate data.

Terraform Plan Cost policy set, entity type and event

Step 1: Add a policy

Create the Rego policy that evaluates the Terraform Plan Cost estimate.

1. In Harness, go to Account Settings → Policies → New Policy.

2. Enter a Name for your policy and click Apply.

3. Add your Rego policy in the editor. Below are two examples matching the built-in samples.

Block cost increases over 10%

package terraform_plan_cost

deny[msg] {
  currentCost := input.costs.totalMonthlyCost
  previousCost := input.costs.pastTotalMonthlyCost
  previousCost > 0
  increase := ((currentCost - previousCost) / previousCost) * 100
  increase > 10
  msg := sprintf("Terraform plan cost increased by %.1f%%, which exceeds the 10%% threshold. Previous: $%.2f, Current: $%.2f", [increase, previousCost, currentCost])
}

Block plans exceeding a total cost limit

package terraform_plan_cost

deny[msg] {
  totalCost := input.costs.totalMonthlyCost
  totalCost > 1000
  msg := sprintf("Terraform plan total monthly cost estimate is $%.2f, which exceeds the $1000 limit.", [totalCost])
}

1. Click Save.

Step 2: Add the policy to a policy set

Add the policy to a policy set scoped to the Terraform Plan Cost entity type.

1. Go to Policies → Policy Sets → New Policy Set.

2. Enter a Name and optional Description.

3. In Entity type, select Terraform Plan Cost.

4. In On what event should the Policy Set be evaluated, select After Terraform Plan.

5. Click Continue.

6. In Policy evaluation criteria, click Add Policy and select your policy.

7. Select the severity (Warn & continue or Error and exit).

8. Click Apply, then click Finish.

Terraform state

Overview

A Terraform State policy evaluates the current state of your Terraform-managed infrastructure. Use this to audit existing resources and ensure ongoing compliance.

The policy is evaluated on the events:

• After Terraform Plan: evaluated after a Terraform Plan step completes.

• After Terraform Apply: evaluated after a Terraform Apply step completes.

Terraform State policy set, entity type and events

Step 1: Add a policy

Create the Rego policy that evaluates Terraform State data.

1. In Harness, go to Account Settings → Policies → New Policy.

2. Enter a Name for your policy and click Apply.

3. Add your Rego policy in the editor. Below is an example that checks EC2 instance types in the current state:

package terraform_state

deny[msg] {
  resource := input.state.resources[_]
  resource.type == "aws_instance"
  instance := resource.instances[_]
  instance.attributes.instance_type == "t2.micro"
  msg := sprintf("Resource '%s' uses instance type 't2.micro' in the current state. Migrate to 't3.micro' or larger.", [resource.name])
}

1. Click Save.

Step 2: Add the policy to a policy set

Add the policy to a policy set scoped to the Terraform State entity type.

1. Go to Policies → Policy Sets → New Policy Set.

2. Enter a Name and optional Description.

3. In Entity type, select Terraform State.

4. In On what event should the Policy Set be evaluated, select After Terraform Plan or After Terraform Apply.

5. Click Continue.

6. In Policy evaluation criteria, click Add Policy and select your policy.

7. Select the severity (Warn & continue or Error and exit).

8. Click Apply, then click Finish.

Policy set entity type selection

When creating a policy set, the Entity Type dropdown lists all three Terraform entity types separately:

Entity type dropdown showing Terraform options

Each entity type must have its own policy set: you cannot mix Terraform Plan, Terraform Plan Cost, and Terraform State policies in a single policy set.

See also

Related governance topics cover the broader policy set workflow.

• Harness Governance Overview

• Policy Samples

Next steps

Continue your governance setup with these related resources.

• Go to Policy Samples to see more Rego examples for Terraform Plan, Terraform Plan Cost, and Terraform State policies.

• Go to Harness Governance Overview to understand how policy sets fit into the wider governance model.

• Go to Harness Governance Quickstart to review the overall governance setup steps.