Migrate from terraform-validator

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

gcloud beta terraform vet is a replacement for the open-source terraform-validator project, with a few minor differences. If you are migrating your CI/CD pipeline to use gcloud beta terraform vet, you will need to make the following changes.

1. Update the command and args

• Replace terraform-validator validate with gcloud beta terraform vet
• Replace --policy-path with --policy-library

Basic example:

# Old
terraform-validator validate ./tfplan.json --policy-path=/path/to/policy-library

# New
gcloud beta terraform vet ./tfplan.json --policy-library=/path/to/policy-library

With service account impersonation:

# Old
GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=[e-mail]
terraform-validator validate ./tfplan.json --policy-path=/path/to/policy-library

# New
gcloud beta terraform vet ./tfplan.json --policy-library=/path/to/policy-library \
  --impersonate-service-account=[e-mail]

2. (Optional) Upgrade constraint templates

terraform-validator documentation historically gave instructions on how to write v1alpha1 Constraint Framework policies; there is a newer format that we recommend for writing new policies. You can also upgrade existing policies to use the new format

For policies sourced from github.com/GoogleCloudPlatform/policy-library, we recommend staying in sync with the remote repository.