Manage policies

Manage Application Security policies, rules, and compliance profiles with Terraform.

Manage Unified Application Security policies through Terraform in order to programmatically define finding types, evaluation conditions, and enforcement actions. You can bind these policies to specific asset groups to ensure your security guardrails are strictly scoped to the correct environments.

Configuration

Use the cortexcloud_appsec_policy resource to configure the finding types, conditions, and enforcement actions. All trigger blocks and nested actions must be explicitly defined.

 # AppSec policy for critical findings
resource "cortexcloud_appsec_policy" "critical_findings" {
  name        = "Critical Findings on Production"
  description = "Alert on critical security issues"
  status      = "enabled"

  # Conditions as JSON (supports up to 10 levels of nesting)
  conditions = jsonencode({
    AND = [
      {
        SEARCH_FIELD = "Severity"
        SEARCH_TYPE  = "EQ"
        SEARCH_VALUE = "CRITICAL"
      }
    ]
  })

  # Each trigger block must be present on CREATE/UPDATE — the API rejects
  # requests that omit any of periodic / pr / cicd / ci_image / image_registry
  # with HTTP 422 ValidateError.
  periodic_trigger = {
    enabled = true
    actions = {
      report_issue = true
    }
  }

  pr_trigger = {
    enabled = true
    actions = {
      report_issue      = true
      report_pr_comment = true
      block_pr          = false
    }
  }

  cicd_trigger = {
    enabled = false
    actions = {
      report_issue = false
      block_cicd   = false
      report_cicd  = false
    }
  }

  ci_image_trigger = {
    enabled = false
    actions = {
      report_issue = false
      report_cicd  = false
      block_cicd   = false
    }
  }

  image_registry_trigger = {
    enabled = false
    actions = {
      report_issue = false
    }
  }

  asset_group_ids = [1]
}

For policy schema details, refer to Policies Schema.

For information on Unified Application Security policies, refer to Unified Application Security policies.

Related workflows

• Manage custom rules
• Manage compliance assessment profiles

Reference

For complete schemas, available filtering parameters, and specific examples for every data source listed above, refer to the official Cortex Cloud Terraform Provider Registry documentation.