access_control

The access_control configuration provides a powerful and flexible way to manage who can perform various operations on your Terraform resources. By defining policies based on user roles, GitHub teams, and repository collaborators, you can ensure that only authorized individuals can trigger potentially impactful actions like applying changes to your infrastructure.

Default Configuration

access_control:
  apply_require_all_dirspace_access: true
  ci_config_update: ['*']
  enabled: true
  files: {}
  plan_require_all_dirspace_access: false
  policies:
    - apply: ['*']
      apply_autoapprove: []
      apply_force: []
      apply_with_superapproval: []
      plan: ['*']
      superapproval: []
      tag_query: ""
  terrateam_config_update: ['*']
  unlock: ['*']

Keys

Key	Type	Description
`apply_require_all_dirspace_access`	boolean	If true, the user must have permission to all targeted dirspace to trigger an apply operation. Default is true.
`ci_config_update`	array	Ruleset for which users can trigger a Terrateam operation on a pull request with a change to the Terrateam CI/CD configuration. Default is `['*']`
`enabled`	boolean	Set to true to enable access control. Default is `true` in Enterprise, Default is `false` in Open Source.
`files`	object	An object where the key is a file path and the value is a ruleset for which users can trigger a Terrateam operation on a pull request with a change to the file.
`plan_require_all_dirspace_access`	boolean	If true, the user must have permission to all targeted dirspaces to trigger a plan operation. Default is `false`.
`policies`	array	A list of policy objects that define access rules for various operations.
`terrateam_config_update`	array	Ruleset for which users can trigger a Terrateam operation on a pull request with a Terrateam configuration file change. Default is `['*']`.
`unlock`	array	Ruleset for which users can trigger an unlock operation on a pull request. Default is `['*']`.

Policies

Key	Type	Description
`apply`	array	Users who can trigger an apply, including autoapply.
`apply_autoapprove`	array	Users who can trigger an apply auto-approve operations.
`apply_force`	array	Users who can trigger an apply-force operation.
`apply_with_superapproval`	array	Allows a user to trigger an apply operation if a user matching the superapproval list has approved the pull request.
`plan`	array	Users who can trigger a plan operation, including autoplan.
`superapproval`	array	Define a list of users whose approvals are considered super approvals.
`tag_query`	string	See tag queries.

Rule Syntax

Syntax	Description
`*`	Matches anyone.
`user:username`	Matches a specific user.
`team:teamname`	Matches any user who is a member of the specified GitHub team.
`role:rolename`	Matches users with the specified repository role. Valid roles are `read`, `triage`, `write`, `maintain`, and `admin`.

GitHub team names must be specified using their slug, which can be retrieved using the GitHub CLI command gh api orgs/<ORG>/teams.

Examples

Here are a few examples of common access control configurations:

Allow Only SRE Team to Apply Changes

access_control:
  policies:
    - tag_query: ''
      plan: ['*']
      apply: ['team:sre']

Require Super Approval for Production Changes

access_control:
  policies:
    - tag_query: 'dir:production'
      apply: []
      apply_with_superapproval: ['*']
      superapproval: ['team:sre']
    - tag_query: ''
      plan: ['*']
      apply: ['*']

Allow Developers to Force Apply in Development Environment

access_control:
  policies:
    - tag_query: 'dir:development'
      apply_force: ['team:developers']

Allow Only SRE Team when CI Configuration has Changed

access_control:
  ci_config_update: ['team:sre']

Allow Only Repo Admins when a File is Changed

access_control:
  files:
    bin/script-that-handles-sensitive-things: ['role:admin']