Policy checks and safety · tfv

Policy checks

Rules run on every plan. In audit mode they report; in enforce mode they also block apply. Only people in override can apply anyway, with tfv apply -p <project> --override. That is audited.

policies:                     # in repos.yaml (server side, so a PR can't change them)
  mode: enforce               # off | audit | enforce (a repo can only make it stricter)
  override: [team:security]
  rules:
    - name: no-public-s3
      resource: aws_s3_bucket_acl
      deny_if: { attribute: acl, in: [public-read, public-read-write] }
    - name: rds-encrypted
      resource: aws_db_instance
      require: { attribute: storage_encrypted, equals: true }
    - name: no-prod-destroy
      projects: ["prod/**"]
      actions: [delete, replace]
      message: Destroying in prod needs a security override
  commands:                   # any scanner; non-zero exit = finding
    - name: checkov
      run: [checkov, -f, "{plan_json}", --framework, terraform_plan, --compact, --quiet]

Rule fields

Field	Meaning
`resource`	A glob on the resource type
`actions`	`create`, `update`, `replace` or `delete`
`projects`	Globs on the project
`deny_if`	A finding when the condition is true
`require`	A finding when the condition is false
neither	The change itself is a finding

Conditions check an attribute path with equals, in, matches (a regex) or exists. Values only known after apply are skipped.

Commands run any scanner against the plan; {plan_json} is replaced with the plan file, and a non-zero exit is a finding.

Findings appear in the PR comment, the check run, and the dashboard's Audit → Policy findings tab.

Two-person rule

two_person_rule: true on a repo, or on a project rule in repos.yaml, means the PR's author can't apply it; someone else with apply rights must.

repos:
  - id: github.com/acme/infra
    two_person_rule: true

Tamper-proof output

GitHub lets anyone with write access edit any comment, including tfv's. tfv never reads its comments back: what gets applied comes from the plan saved on the server, and check runs (which users can't edit) and the dashboard are the trusted record.

If someone edits or deletes a tfv comment, tfv posts a warning naming who did it, with a link to the comment and a "View the original" section, and logs it in the audit log.