> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-policies.md).

# Manage policies

Manage Unified Application Security policies through Terraform in order to programmatically define finding types, evaluation conditions, and enforcement actions. You can bind these policies to specific asset groups to ensure your security guardrails are strictly scoped to the correct environments.

### Configuration

Use the `cortexcloud_appsec_policy` resource to configure the finding types, conditions, and enforcement actions. All trigger blocks and nested actions must be explicitly defined.

```terraform
 # AppSec policy for critical findings
resource "cortexcloud_appsec_policy" "critical_findings" {
  name        = "Critical Findings on Production"
  description = "Alert on critical security issues"
  status      = "enabled"

  # Conditions as JSON (supports up to 10 levels of nesting)
  conditions = jsonencode({
    AND = [
      {
        SEARCH_FIELD = "Severity"
        SEARCH_TYPE  = "EQ"
        SEARCH_VALUE = "CRITICAL"
      }
    ]
  })

  # Each trigger block must be present on CREATE/UPDATE — the API rejects
  # requests that omit any of periodic / pr / cicd / ci_image / image_registry
  # with HTTP 422 ValidateError.
  periodic_trigger = {
    enabled = true
    actions = {
      report_issue = true
    }
  }

  pr_trigger = {
    enabled = true
    actions = {
      report_issue      = true
      report_pr_comment = true
      block_pr          = false
    }
  }

  cicd_trigger = {
    enabled = false
    actions = {
      report_issue = false
      block_cicd   = false
      report_cicd  = false
    }
  }

  ci_image_trigger = {
    enabled = false
    actions = {
      report_issue = false
      report_cicd  = false
      block_cicd   = false
    }
  }

  image_registry_trigger = {
    enabled = false
    actions = {
      report_issue = false
    }
  }

  asset_group_ids = [1]
}
```

For policy schema details, refer to [Policies Schema](https://registry.terraform.io/providers/PaloAltoNetworks/cortexcloud/latest/docs/resources/appsec_policy).

For information on Unified Application Security policies, refer to [Unified Application Security policies](/application-security/application-security-posture-management-aspm/unified-application-security-policies.md).

### Related workflows

* [Manage custom rules](/application-security/terraform-workflows/manage-resources/manage-custom-rules.md)
* [Manage compliance assessment profiles](/application-security/terraform-workflows/manage-resources/manage-compliance-assessment-profiles.md)

#### Reference

For complete schemas, available filtering parameters, and specific examples for every data source listed above, refer to the official [Cortex Cloud Terraform Provider Registry](https://registry.terraform.io/providers/PaloAltoNetworks/cortexcloud/latest/docs) documentation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.