Ensure Terraform HCL uses trusted / official providers configured MQL?

[scottford-io]

I want to create an assertion with MQL to check to see if the requried_providers in my Terraform are on an approved list of providers. For example

approvedProviders = [ 
  "hashicorp/aws", 
  "hashicorp/google", 
  "hashicorp/azurerm", 
  "hashicorp/azuread",  
  "hashicorp/vsphere"
]

cnquery> terraform.blocks.where( snippet.contains( "required_providers" ) ) { blocks {*}}
terraform.blocks.where: [
  0: {
    blocks: [
      0: {
        labels: []
        attributes: {
          aws: {
            type: "object({source=string,version=string})"
            value: {
              source: "hashicorp/aws"
              version: "~> 4.23.0"
            }
          }
          docker: {
            type: "object({source=string,version=string})"
            value: {
              source: "kreuzwerker/docker"
              version: "~> 2.19.0"
            }
          }
          kubernetes: {
            type: "object({source=string,version=string})"
            value: {
              source: "hashicorp/kubernetes"
              version: "~> 2.12.1"
            }
          }
          local: {
            type: "object({source=string,version=string})"
            value: {
              source: "hashicorp/local"
              version: "~> 2.2.3"
            }
          }
          null: {
            type: "object({source=string,version=string})"
            value: {
              source: "hashicorp/null"
              version: "~> 3.1.1"
            }
          }
          random: {
            type: "object({source=string,version=string})"
            value: {
              source: "hashicorp/random"
              version: "~> 3.3.2"
            }
          }
        }
        arguments: {
          aws: {
            source: "hashicorp/aws"
            version: "~> 4.23.0"
          }
          docker: {
            source: "kreuzwerker/docker"
            version: "~> 2.19.0"
          }
          kubernetes: {
            source: "hashicorp/kubernetes"
            version: "~> 2.12.1"
          }
          local: {
            source: "hashicorp/local"
            version: "~> 2.2.3"
          }
          null: {
            source: "hashicorp/null"
            version: "~> 3.1.1"
          }
          random: {
            source: "hashicorp/random"
            version: "~> 3.3.2"
          }
        }
        type: "required_providers"
        end: terraform.fileposition id = file.position/versions.tf/2/3
        start: terraform.fileposition id = file.position/versions.tf/2/3
        blocks: []
        snippet: "     1 | terraform {
     2 |   required_providers {
     3 |     aws = {
     4 |       source  = \"hashicorp/aws\"
     5 |       version = \"~> 4.23.0\"
"
        nameLabel: ""
      }
    ]
  }
]

[arlimus]

If I read this right, are you looking at the list of arguments and to see if their source is in the list of approved providers?

[scottford-io]

@arlimus that is correct.

For context, the business problem is similar to the problem of configuring package repositories internally, or container registries. A business should be able to declare a set of approved TF modules/providers, and before a terraform plan or terraform apply is executed, be able to ensure that no "untrusted" providers or modules are being used.