Skip to main content
Manages a Kosli control. Controls are org-level definitions of SDLC requirements (for example SDLC-001 “Binary provenance”) whose compliance is evaluated from attestations and enforced through environment policies.
Controls is a beta feature and must be enabled for your organization; API requests return 403 Forbidden otherwise.
Deleting this resource archives the control in Kosli rather than hard-deleting it. Creating a new control with the identifier of an archived control fails with a conflict; unarchive the control in Kosli and import it instead.

​
Example usage

terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Control requiring binary provenance for production artifacts
resource "kosli_control" "binary_provenance" {
  identifier  = "SDLC-001"
  name        = "Binary provenance"
  description = "All production artifacts must have build provenance attestations"

  links = {
    docs = "https://example.com/sdlc/binary-provenance"
  }

  tags = {
    framework = "finos-sdlc"
    team      = "platform"
  }
}

# Minimal control with only the required attributes
resource "kosli_control" "peer_review" {
  identifier = "SDLC-002"
  name       = "Peer review"
}

​
Import

Controls can be imported using their identifier: 
# Import an existing control by identifier
terraform import kosli_control.binary_provenance SDLC-001

​
Querying controls

To reference an existing control and access metadata such as the current version, tags, and referencing policies, use the kosli_control data source.

​
Schema

​
Required

  • identifier (String) Unique identifier of the control within the organization (e.g. SDLC-001). Must start with a letter or number and contain only letters, numbers, periods (.), hyphens (-), underscores (_), and tildes (~). Changing this will force recreation of the resource.
  • name (String) Human-readable display name of the control (e.g. Binary provenance). Can be changed without recreating the control.

​
Optional

  • description (String) Free-form description of the control.
  • links (Map of String) Named links related to the control (e.g. documentation or runbook URLs), as a map of link name to URL.
  • tags (Map of String) Key-value pairs to tag the control.

​
Read-only

  • created_at (String) RFC3339 UTC timestamp of when the control was created.
  • created_by (String) Identifier of the user who created the control.
  • policies_referencing (List of String) Names of the environment policies that reference this control.
  • version (Number) Version number of the control, assigned by the server and incremented on every update.
Last modified on July 10, 2026