Manage Terraform Run Tasks enforcement

Enforce Application Security guardrails during Terraform planning.

Declaratively dictate which infrastructure misconfigurations or exposed secrets will trigger a Run Task failure during the terraform plan phase, blocking insecure infrastructure from being deployed.

Prerequisites

• Establish integration: The HCP Terraform Run Task integration must already be configured. Refer to Terraform Cloud (Run Tasks) or Terraform Enterprise (Run Tasks).
• Asset Groups: Target Asset Groups must be established. Refer to Manage Asset Groups.

Configuration

Use the cortexcloud_appsec_policy resource to define the finding types and conditions When HCP Terraform triggers the Run Task, Cortex Cloud evaluates the plan against the cicd_trigger actions defined in this policy to determine if the plan should be blocked.

# Example: Enforce a Run Task block for Critical IaC misconfigurations
resource "cortexcloud_appsec_policy" "run_task_iac_guardrails" {
  name        = "HCP Run Task IaC Guardrails"
  description = "Blocks Terraform Run Tasks if critical IaC misconfigurations are detected in the plan."
  status      = "enabled"

  # SCOPE: Target the asset group representing your Terraform workspaces
  asset_group_ids = [1]

  # Conditions: Evaluate severity (Requires uppercase keys per provider schema)
  conditions = jsonencode({
    AND = [
      {
        SEARCH_FIELD = "Severity"
        SEARCH_TYPE  = "EQ"
        SEARCH_VALUE = "CRITICAL"
      }
    ]
  })

  # Actions: The Run Task integration evaluates this block to determine block/pass status
  cicd_trigger = {
    enabled = true
    actions = {
      report_issue = true
      block_cicd   = true  # Fails the HCP Terraform Run Task
      report_cicd  = true
    }
  }

  # Unused triggers required by schema validation
  pr_trigger = {
    enabled = false
    actions = { report_issue = false, report_pr_comment = false, block_pr = false }
  }
  periodic_trigger = {
    enabled = false
    actions = { report_issue = false }
  }
  ci_image_trigger = {
    enabled = false
    actions = { report_issue = false, report_cicd = false, block_cicd = false }
  }
  image_registry_trigger = {
    enabled = false
    actions = { report_issue = false }
  }
}