Skip to content

Functions

The function set available in profile and control expressions, and where it applies.

On this page

This page lists the functions available in expressions, states where an expression is evaluated, and shows one worked example.

Scope

Rule Detail
Evaluated at load time Variable defaults, validation conditions, and the address attribute of a check
Not evaluated Assertion attributes and blocks. The provider decodes them as raw values when the check runs
Purity Every function is pure and deterministic. No filesystem, environment, or clock access
Result A profile evaluates identically wherever it is loaded

Catalogue

Group Functions
Numeric abs, ceil, floor, max, min, parseint
String chomp, format, formatlist, indent, join, lower, regex, regexall, replace, split, strlen, substr, title, trim, trimprefix, trimspace, trimsuffix, upper
Collection coalesce, coalescelist, compact, concat, contains, distinct, element, flatten, keys, length, lookup, merge, range, reverse, slice, sort, values, zipmap
Encoding csvdecode, jsondecode, jsonencode

Example

variable "ssh_config_dir" {
  type    = "string"
  default = "/etc/ssh"
}

variable "env" {
  type    = "string"
  default = "prod"

  validation {
    condition     = contains(["prod", "staging"], lower(trimspace(var.env)))
    error_message = "env must be prod or staging."
  }
}

control "ssh-03" {
  title  = "Environment sshd drop-in is owned by root"
  impact = 0.6

  check "dropin-owner" "file" {
    path  = format("%s/sshd_config.d/%s.conf", trimsuffix(var.ssh_config_dir, "/"), lower(var.env))
    owner = "root"
    mode  = "0600"
  }
}
Function Position Effect
trimspace, lower validation condition Normalise the override before checking it. --var env=" Staging" passes
contains validation condition Reject any value outside the allowed list at load time
trimsuffix address attribute Strip a trailing slash. --var ssh_config_dir=/etc/ssh/ does not produce //
format address attribute Build the path from the directory and the normalised environment name
Input Resolved path
Defaults /etc/ssh/sshd_config.d/prod.conf
--var env=Staging /etc/ssh/sshd_config.d/staging.conf

owner and mode are assertions. The file provider decodes them as raw values. A function call in either is not evaluated.