Rules Preview, the Playground, and Six More Rules Are Live

In March I wrote that Operational Rules let you stop forking terraform-aws-modules to add a lifecycle block. Since then the question I get most is "what exactly will it do to my module". You can now answer that yourself, before you touch anything.

This post is the changelog for Operational Rules since March: the Rules Playground and the Preview API behind it, six more rules, Baseline and rulesets, and a set of docs pages that walk through the known Terraform limits one module at a time.

The Rules Playground

Open registry.compliance.tf/playground, pick one of the reviewed terraform-aws-modules modules, tick the rules you want, press Run preview, and read the diff. It is the same engine the registry runs at download, applied to the same module at the version the Playground pins, so the change you see in the module root is the change a download makes there. It needs no account and no terraform init.

If you would rather script it, the public Preview API answers curl. The Rules Preview guide documents the public route, the private one that previews against your organization's Baseline, and the response you get back. One thing to know before you read it: the public route's response carries an outcomes entry per rule, so a rule that matched nothing in the module reports not_applicable.

Six more rules

The catalog now has fifteen selectable rules. The six added since March:

• Create Before Destroy adds create_before_destroy = true to security groups and ACM certificates, so a replacement exists before the old one is destroyed.
• Ignore Deployed Artifacts stops Terraform from rolling back the Lambda zip, image, or ECS task definition a pipeline deployed.
• Ignore Scaling Changes leaves the desired capacity an autoscaler owns on Auto Scaling groups, EKS node groups, and ECS services alone.
• Ignore Secret Rotation ignores a database password that rotates outside Terraform, on RDS instances and Aurora clusters.
• Set Deletion Protection turns on the provider's deletion protection where a module leaves it unset, on RDS, Aurora, DynamoDB tables, and load balancers.
• Abort Incomplete Multipart Uploads adds a validation to the S3 module's lifecycle_rule input so a bucket without an abort rule is rejected at terraform validate or plan, before apply.

Every rule page shows the before and after, its limits, and its failure modes. The full list is in the Rule Catalog.

These rules come from the forks and support requests we see. If the rule your fork carries is missing, or one of these does not do what your block does, tell us through the contact page and say which module and which resource. That is how the next six get chosen.

Baseline and rulesets

Organization admins group rules on the dashboard. A Baseline applies to every module your organization downloads. A named ruleset applies only to the modules that select it with ?ruleset=<name>. Both need an organization on a trial, paid, or enterprise plan, and both are described in Baseline rules and rulesets.

For a one-off you do not need any of that. On registry.compliance.tf and the framework hosts, ?add_rules= on the source line adds a rule to that download, and ?rules=-<id> takes one away. The getting started guide has the grammar; the short version is that a bare ?rules= list replaces, ?add_rules= adds.

Known limits, module by module

The docs now carry one page per module for the recurring problems no module can fix, because a lifecycle block cannot take a variable. Each page names the native workaround first, then the rule that answers it where one exists, then the Playground diff. RDS, EKS, Lambda, ECS, S3, DynamoDB, and more are covered at Terraform workarounds, module by module. Where no rule exists yet the page says so and the native option is the whole answer.

What is next

Org-authored rules, so a platform team can write a transformation for a standard we do not cover, and versioned rulesets with an approval step before a change reaches a download. The Operational Rules page tracks both.

If you forked terraform-aws-modules to hold a lifecycle block, the next post is for you: From Fork to One Source Line.