Reference

match_on / match_with Operator Reference

Full operator reference for match_on and match_with arrays, including value, regexp, expression, and or logic.

Edit this page on GitHub

match_on and match_with Operator Reference

Used to filter resources conditionally in match_on and match_with arrays. All objects in the array follow AND logic.

Operator Type Description
property String (Required) The property to evaluate. Supports dot notation traversal (domain.owner).
relation String Optional. When set, property refers to a property of outgoing relations with this label instead of the node itself.
value Any Exact equality check. Supports Tera.
not Any Inequality check. Supports Tera.
contains String Substring match for strings, or element match for arrays. Supports Tera.
excludes String Ensures substring or element is missing. Supports Tera.
exists Boolean Checks if property is present and not null.
empty Boolean Checks if property is missing, null, "", or [].
greater Number Strictly greater than (>).
lower Number Strictly less than (<).
regexp String Regular expression match. Supports Tera templating.
expression String Evaluates a Tera template directly; matches if result is exactly "true".
or Array Used to nest condition objects with logical OR (e.g., Disjunctive Normal Form).
in Array, String Matches if the property’s value is contained in this list or comma-separated string.

match_on is only valid inside rule blocks such as [[create_resource]], [[link_resources]], [[output]], [[control]], or [[action]]. At file header scope it is ignored.

Notes on expression

  • The template must render exactly the string "true" to match — a common pattern is {% if <condition> %}true{% endif %}.
  • Inside [[link_resources]] match_with expressions, both origin_resource and target_resource are available; in other contexts typically only origin_resource.
  • Tera’s in operator is not supported in these expressions and fails with a render error. Use tests instead: is containing(...) for substring/multi-value cell matching and is ending_with(...) for suffix matching.
# Multi-value cell: link when the algorithm name appears in the endpoint's `algorithms` list
{ expression = "{% if origin_resource.algorithms is containing(target_resource.name) %}true{% endif %}" }

# Suffix match: link a certificate to its parent domain
{ expression = "{% if origin_resource.name is ending_with(target_resource.name) %}true{% endif %}" }

Relation-Property Matching

Set relation to evaluate a condition against properties stored on the relationship instead of the node. The condition looks at every outgoing relation with the given label from the node being evaluated and succeeds if any matching relation satisfies the condition.

# In a compliance rule: flag computes whose DEPLOYED_AS relations lacks encryption
[[control]]
name = "deployment-must-be-encrypted"
[[control.target]]
origin_resource_types = ["compute"]
match_on = [
  { relation = "DEPLOYED_AS", property = "encrypted", value = false }
]

If property is omitted or empty and relation is set, the condition checks only for the existence of a relation with that label. This behaves like the node-level exists operator, but scoped to a specific relationship.