Wire policy evaluation into Terraform core runtime by dsa0x · Pull Request #38516 · hashicorp/terraform

dsa0x · 2026-05-04T14:16:52Z

This is part of a stacked series to upstream the policy work in smaller, reviewable pieces:

This PR wires policy evaluation into Terraform core itself. It adds the runtime behavior for evaluating policy during graph execution, passes the relevant metadata and values into the policy engine, and records the resulting policy outcomes back onto the run so later layers can surface them.

This is the core of the stack. The main thing happening here is not CLI behavior yet, but rather defining where policy runs in the Terraform runtime, what objects get evaluated, and how those results are tracked.

Included here

policy evaluation during core graph/runtime execution
provider/resource runtime wiring
core tests covering policy behavior
supporting core/test plumbing needed to make that work

Target Release

1.16.x

Rollback Plan

If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

This change is user-facing and I added a changelog entry.
This change is not user-facing.

SarahFrench

I'm still looking through this PR, and it's a lot easier after the meeting we had yesterday (thank you!). I'll continue looking but I figured I'd share an initial round of comments.

github-actions · 2026-05-28T12:05:19Z

The equivalence tests failed. Please investigate here.

Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com>

SarahFrench

I'm still looking through, but here are some more comments 📝

SarahFrench

Approved - I've looked through all the changes and have no further questions or feedback.

austinvalle

Apologies for the late review 😅 , left a few comments/questions

austinvalle · 2026-06-01T14:11:06Z

+	addrs := s.state.allResourceInstanceObjectAddrs(func(objAddr addrs.AbsResourceInstanceObject) bool {
+		return objAddr.ResourceInstance.ConfigResource().Equal(addr)
+	})
+	s.lock.RUnlock()


Was this unlock meant to be deferred? Looks like we're accessing s.state after the mutex been unlocked 👀

Good catch. Thank you!.

austinvalle · 2026-06-01T19:42:03Z

+		if policyGraph := ctx.PolicyGraph(); policyGraph != nil && !n.preDestroyRefresh {
+			policyGraph.Add(policyNodeFromChange(change))
+		}


Are we expecting that data sources should also have a policy node added? It looks like they also use this writeChange method to plan 👀

terraform/internal/terraform/node_resource_plan_instance.go

Line 144 in 581ffab

diags = diags.Append(n.writeChange(ctx, change, ""))

Good catch. This never caused a problem because data source changes are denoted as Read, so we never send them for policy evaluation. However it does make sense to not have a node for them in the first place

austinvalle · 2026-06-01T19:46:05Z

+	default:
+		return nil


nit: Is this switch statement meant to be exhaustive? If not, a log mentioning why we're skipping policy evaluation could be helpful for future debuggers 👀

It isn't exhaustive, as there are other actions that we do not care about. Adding a log here.

austinvalle · 2026-06-01T19:48:05Z

+	if modCfg == nil {
+		return nil
+	}


nit: Is this expected? Feels like it should either be a panic (internal implementation error) or a log (expected skip of policy evaluation) 🤔

austinvalle · 2026-06-01T20:09:06Z

+			readResp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+				TypeName:     target,
+				Config:       configVal,
+				ProviderMeta: meta,


Very interesting 👀 , was it specifically requested that we add provider meta here? I'm not 100% sure how it's being used today by the providers, but I believe the usage of it was more analytics then functional behavior of ReadDataSource (I also vaguely remember it being related to module usage, but here the context is the resource policy is using it, not the actual configuration... not sure if the distinction is important 🤔 )

Yeah, meta only has to do with tracking module usage. If this config isn't coming directly from module usage, this probably shouldn't be used here.

Right.. I dont have much knowledge about the origins of that object in the request. However, this data source evaluation uses the same provider as the module of the current resource whose policy is being evaluated. So I am not sure it would be a bad idea when we send this meta and the provider translates it as part of the module usage.

jbardin · 2026-06-02T12:24:45Z

+func getDataSourceForPolicyCallback(ctx EvalContext, provider providers.Interface, schema providers.GetProviderSchemaResponse, meta cty.Value) func(datasource string, attrs cty.Value) (cty.Value, error) {
+	return func(target string, attrs cty.Value) (cty.Value, error) {
+		if datasource, ok := schema.DataSources[target]; ok {
+			configVal, err := datasource.Body.CoerceValue(attrs)


Why would the config require CoerceValue? It looks like it's patching over a typing bug elsewhere.

The config here does not come from a parsed terraform configuration. It comes from the policy engine, which means it has not been validated, and is merely denoted as an object thus far. CoerceValue would allow us to validate it against the schema.

dsa0x added the no-changelog-needed Add this to your PR if the change does not require a changelog entry label May 4, 2026

This was referenced May 5, 2026

Add policy client and protocol plumbing #38514

Merged

Add policy result types and diagnostic metadata plumbing #38515

Closed

Add CLI and backend policy wiring for plan apply and query #38518

Merged

Add init-time policy evaluation #38519

Draft

dsa0x force-pushed the policy-pr3-core-runtime branch from ac6ebf9 to fb1a082 Compare May 15, 2026 12:13

dsa0x marked this pull request as ready for review May 18, 2026 09:52

dsa0x requested a review from a team as a code owner May 18, 2026 09:52

dsa0x force-pushed the policy-pr2-results-diags branch from c3a1b4b to f309492 Compare May 19, 2026 14:07

dsa0x requested review from a team as code owners May 19, 2026 14:07

dsa0x force-pushed the policy-pr2-results-diags branch 2 times, most recently from fabac57 to 7f791cd Compare May 21, 2026 11:43

dsa0x force-pushed the policy-pr3-core-runtime branch from e691a08 to a6d3871 Compare May 21, 2026 16:03

dsa0x changed the base branch from policy-pr2-results-diags to main May 22, 2026 13:56

dsa0x force-pushed the policy-pr3-core-runtime branch 4 times, most recently from 35ef0a8 to def6dde Compare May 26, 2026 12:37

dsa0x added 10 commits May 26, 2026 23:22

Add policy result types and diagnostic metadata plumbing

606472a

add tests

283b020

Wire policy evaluation into Terraform core runtime

553d46f

fix code diagnostics

8533a62

remove LocalName

516f65e

Policy: dedicated data structure for tracking policy evaluation data

0237e1f

remove inline sig

82ce2f2

post-merge conflict cleanup

af623e9

add graph builder test

2e80182

remove unused structs

9571690

dsa0x added 3 commits May 26, 2026 23:22

removed more unused structs

f24fa97

retrieve callbacks from state during apply

30af10f

Tolerate upstream failures for policy node

d4ca814

dsa0x force-pushed the policy-pr3-core-runtime branch from 82875dc to d4ca814 Compare May 26, 2026 21:22

SarahFrench reviewed May 28, 2026

View reviewed changes

add improved comments, remove unused code

289ba05

fix nil bug

6216d80

dsa0x force-pushed the policy-pr3-core-runtime branch from 2676716 to 104673a Compare May 28, 2026 12:12

Apply suggestions from code review

1e97ca1

Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com>

dsa0x force-pushed the policy-pr3-core-runtime branch from 104673a to 1e97ca1 Compare May 28, 2026 13:10

Merge branch 'main' into policy-pr3-core-runtime

07f6076

dsa0x requested a review from SarahFrench May 29, 2026 06:16

SarahFrench reviewed May 29, 2026

View reviewed changes

Comment thread internal/terraform/graph_builder_apply.go

Comment thread internal/terraform/node_provider.go Outdated

Comment thread internal/terraform/node_provider_abstract.go Outdated

remove unused params

acbabc3

dsa0x force-pushed the policy-pr3-core-runtime branch from 2e848ac to acbabc3 Compare June 1, 2026 07:38

Update comments

dd98328

SarahFrench approved these changes Jun 1, 2026

View reviewed changes

dsa0x merged commit 7d22d46 into main Jun 1, 2026
14 checks passed

dsa0x deleted the policy-pr3-core-runtime branch June 1, 2026 10:58

austinvalle reviewed Jun 1, 2026

View reviewed changes

jbardin reviewed Jun 2, 2026

View reviewed changes

dsa0x mentioned this pull request Jun 2, 2026

Address comments in policy evaluation wiring PR #38669

Merged

3 tasks

Conversation

dsa0x commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Included here

Target Release

Rollback Plan

Changes to Security Controls

CHANGELOG entry

Uh oh!

SarahFrench left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 28, 2026

Uh oh!

SarahFrench left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SarahFrench left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

austinvalle left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

austinvalle Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dsa0x commented May 4, 2026 •

edited

Loading

austinvalle Jun 1, 2026 •

edited

Loading