Migrate from terraform-validator

gcloud beta terraform vet is a replacement for the open-source terraform-validator project, with a few minor differences. If you are migrating your CI/CD pipeline to use gcloud beta terraform vet, you will need to make the following changes.

1. Update the command and args

  • Replace terraform-validator validate with gcloud beta terraform vet
  • Replace --policy-path with --policy-library

Basic example:

# Old terraform-validator validate ./tfplan.json --policy-path=/path/to/policy-library # New gcloud beta terraform vet ./tfplan.json --policy-library=/path/to/policy-library

With service account impersonation:

# Old GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=account@project.iam.gserviceaccount.com terraform-validator validate ./tfplan.json --policy-path=/path/to/policy-library # New gcloud beta terraform vet ./tfplan.json --policy-library=/path/to/policy-library \  --impersonate-service-account=account@project.iam.gserviceaccount.com

2. (Optional) Upgrade constraint templates

terraform-validator documentation historically gave instructions on how to write v1alpha1 Constraint Framework policies; there is a newer format that we recommend for writing new policies. You can also upgrade existing policies to use the new format

For policies sourced from github.com/GoogleCloudPlatform/policy-library, we recommend staying in sync with the remote repository.