Terraform Provider

​

4.23.2

​

New

• Add end_user_email_expression to formal_integration_oidc to extract the email address of the end user from the claims

​

4.23.0

​

New

• Add compression to formal_integration_log to compress logs written to S3 and Google Cloud Storage, with gzip or zstd
• Add the formal_integration_oidc resource to manage OIDC integrations

​

Fixed

• Fix an issue where AWS formal_integration_cloud resources always showed a pending change in plans

​

4.22.0

​

New

• Add the formal_connector_token_encryption_key resource to manage token encryption keys for the Connector
• Add the formal_ssh_host_key resource to manage SSH host keys for the Connector

​

Changed

• Remove the deprecated formal_sidecar and formal_sidecar_resource_link resources
• Improve GCP and AWS deployment Examples
• Update to Formal Go SDK v3. This improves supply chain security by removing hosted Protobuf dependencies.

​

4.21.1

​

New

• Add support for allowlisted_network_hosts on the formal_hook resource
• Add support for more GCP autodiscovery options to formal_integration_cloud

​

4.21.0

​

New

• Add the formal_hook resource to manage policy evaluation hooks
• Add GCP support to formal_integration_cloud with the new gcp block, including autodiscovery for Cloud SQL instances, Compute Engine instances, and GKE clusters, and log writes to GCS
• Add the formal_integration_cloud_gcp_activation resource to activate a GCP Cloud Integration by reporting its service account and workload identity pool provider back to Formal
• Add Google Cloud Storage as a log destination on formal_integration_log with the new gcs block
• Add Fleet and Jamf Pro integrations to formal_integration_mdm, alongside the existing Kandji integration

​

Changed

• formal_integration_mdm: MDM API keys (Kandji, Fleet, Jamf) are now write-only and no longer stored in Terraform state (requires Terraform 1.11 or later)
• formal_integration_cloud: cloud_region is now optional and applies to AWS only

​

4.20.0

​

New

• Add a formal_user data source to look up an existing user by ID or identity (idp:formal:human:<email>)

​

4.19.0

​

New

• Create AWS and GCP resources with the new aws and gcp technology types
• formal_resource_tls_configuration: present a client certificate to upstream resources with the new mutual TLS fields (tls_client_cert, tls_client_key)
• formal_inventory_object: declare labeled JSON sub-columns so nested JSON fields can be masked by data label

​

4.18.0

​

New

• Support GCP KMS encryption keys, alongside AWS KMS
• Reach resource upstreams through AWS Systems Manager with the new aws_ssm dial method

​

Changed

• Encryption keys now use asymmetric RSA by default. Symmetric and deterministic algorithms are no longer supported, and the algorithm field is deprecated.
• The aws key provider is renamed to aws-kms (aws still works as a deprecated alias)

​

4.17.2

​

Changed

• formal_resource: port can now be updated in place instead of forcing the resource to be recreated

​

4.17.1

​

Fixed

• formal_resource_dial_configuration: dial_target can now reference an attribute from another resource (e.g. a Cloud SQL instance created in the same plan) without terraform plan failing

​

4.17.0

​

New

• Add formal_resource_dial_configuration resource to control how the connector dials a resource’s upstream (tcp or gcp_cloudsql)

​

4.16.3

​

New

• Add formal_network_rule resource to define CEL-based network routing rules

​

4.16.2

​

Removed

• Remove owner and notification fields on the formal_policy resource.

​

4.16.1

​

New

• Add s3_bucket_prefix to formal_integration_log AWS S3 configuration to write logs under a specific bucket prefix

​

Changed

• Update formal_sidecar_resource_link deprecation message to reference formal_connector_listener with connector_id

​

4.16.0

​

New

• Add formal_inventory_object resource to register inventory objects (database, schema, table, column) directly, instead of relying on discovery
• Add input_json field on formal_form options source command for payloads with non-string JSON values

​

Removed

• Remove formal_integration_data_catalog resource (deprecated since 4.12.7)

​

4.15.2

​

New

• Add autodiscovery_regions to formal_integration_cloud AWS config to enable multi-region resource autodiscovery

​

4.15.1

​

Changed

• Bump generated protobuf dependency

​

4.15.0

​

New

• Allow llm as a technology in formal_connector_listener_rule

​

Removed

• Remove formal_data_domain resource (data domains have been removed)

​

4.14.13

​

New

• Add formal_connector_ai_provider resource for managing hosted AI providers
• Add hosted AI provider fields to formal_connector_configuration

​

4.14.12

​

New

• Support formal_form resources

​

4.14.11

​

New

• Add support for resource aliases

​

4.14.10

​

Changed

• Store the Formal IAM role ARN in the Terraform state for AWS cloud integration resources.

​

4.14.9

​

Changed

• Add validation for write-only attribute version for native users

​

4.14.8

​

New

• Add support for ai satellite type to formal_connector_satellite_link resource

​

4.14.7

​

Changed

• Support status on formal_workflow resources.

​

4.14.6

​

New

• Add the formal_workflow resource.
• Add resources_health_checks_frequency_seconds to control resource health check frequency.
• Introduce connector and space data sources.

​

4.14.1

​

New

• Add otel_endpoint_hostname and otel_endpoint_port fields to formal_connector_configuration resource to support custom OpenTelemetry collector endpoints

​

4.14.0

​

Changed

• Deprecate data_classifier satellite type in favor of ai satellite type

​

4.13.2

​

New

• Add satellite link resource

​

4.13.1

​

New

• Add policy_eval_input_retention attributes to log configuration resources

​

4.13.0

​

New

• Add write-only attributes (native_user_secret_wo, native_user_secret_wo_version) for native users to avoid storing secrets in Terraform state (requires Terraform 1.11+)

​

4.12.8

​

Changed

• Require ai_analysis_timeout_seconds to avoid stalled AI analyses and ensure predictable timeouts

​

4.12.7

​

New

• Add S3 autodiscovery option for Cloud integration to discover buckets

​

Changed

• Deprecate Data Catalog integration resource to signal phase-out
• Require specific fields in Sidecar, Sidecar Link, MFA, and TLS to prevent invalid configs

​

4.12.6

​

Fixed

• Fix formal_integration_mdm creation to prevent apply crashes and use the resource name

​

4.12.5

​

Changed

• Make decryptor_uri optional for encryption_key to avoid unnecessary configuration

​

4.12.3

​

Fixed

​

4.12.2

​

New

• Add S3 bucket autodiscovery to integration_cloud to reduce manual setup

​

Changed

• Update RPC library to latest version for improved stability and compatibility
• Update documentation generator to latest version for clearer provider docs

​

4.11.3

​

New

• Add optional connector_id to connector_listener to link on create

​

4.11.2

​

New

• Add AI timeout and strict result count to resource_classifier_configuration

​

4.11.1

​

Changed

• Require satellite_type on satellite resource; use data_discovery, data_classifier, or policy_data_loader

​

4.11.0

​

New

• Add no-sync mode for Metabase integrations; create integrations without Metabase credentials
• Add support for customer-managed TLS certificates

​

4.10.4

​

Changed

• Revert self-supplied TLS on connector_hostname; remove certificate/private_key args to restore prior behavior

​

4.10.3

​

New

• Add satellite_hostname and connector_satellite_link resources to manage satellites

​

Fixed

• Set default log payload size limit to -1 for consistent log behavior

​

Changed

• Remove health check port from connector_configuration

​

4.10.2

​

New

• Add option to set customer AWS role ARN in integration_cloud to simplify setup without CloudFormation

​

4.10.1

​

Fixed

• Make technology_provider optional unless using SSH with SSM, reducing config errors

​

4.10.0

​

Changed

• Redesign log_configuration with request/response/scope blocks for clearer control
• Require name and encryption_key_id; remove legacy encryption and size settings for clarity

​

4.9.1

​

Changed

• Require decryptor_uri on encryption_key resource for frontend decryption

​

4.9.0

​

New

• Add formal_group data source to reference existing groups by name

​

Fixed

• Block creating connector listeners on healthcheck port 8080 to avoid conflicts

​

Changed

• Update dependencies to improve stability and compatibility

​

4.8.0

​

New

• Add per-resource classifier preference for fine-grained control

​

4.7.2

​

Fixed

• Prevent forced recreation when updating provider field, allowing in-place updates

​

4.7.1

​

Changed

• Require provider for SSH resources using SSM (aws-ec2 or aws-ecs)
• Switch KMS encryption key input to use key ARN instead of key ID
• Update TLS validation options for clearer, safer configuration

​

4.7.0

​

New

• Add formal_resource data source to fetch a resource by name for easier lookups

​

4.6.2

​

Fixed

• Improve permission update errors to reflect ‘code’ field name

​

Changed

• Update permission resource to use ‘code’ and remove timestamps to prevent plan drift

​

4.6.1

​

New

• Add optional path to Data Discovery to limit scans to a specific subpath

​

4.6.0

​

New

• Add resource formal_inventory_object_data_label_link to link data labels to inventory objects
• Add EC2 and ECS autodiscovery to cloud integration, with computed status fields

​

4.5.3

​

New

• Add formal_connector_configuration to set connector log level and health check port for better monitoring

​

4.5.2

​

Changed

• Allow in-place updates to primary hostname to reduce downtime

​

4.5.1

​

New

• Add plan-time validation for policy Rego code to catch errors before apply

​

4.5.0

• Add autodiscovery and log delivery fields to the aws configuration block of formal_integration_cloud resources:
  • enable_eks_autodiscovery toggles EKS clusters autodiscovery
  • enable_rds_autodiscovery toggles RDS instances (PostgreSQL, MySQL, MongoDB) autodiscovery
  • enable_redshift_autodiscovery toggles Redshift clusters autodiscovery
  • allow_s3_access allows Formal to send logs to S3 buckets in your AWS account through Log Integrations
• Add read-only fields to the root level of formal_integration_cloud resources for CloudFormation stack parameters:
  • aws_enable_eks_autodiscovery provides the value for the EnableEKSAutodiscovery parameter
  • aws_enable_rds_autodiscovery provides the value for the EnableRDSAutodiscovery parameter
  • aws_enable_redshift_autodiscovery provides the value for the EnableRedshiftAutodiscovery parameter
  • aws_allow_s3_access provides the value for the AllowS3Access parameter
  • aws_s3_bucket_arn provides the value for the S3BucketARN parameter

​

4.4.1

• Bumped Formal Go SDK from 2.8.1 to 2.8.2

• Brought back the type field of formal_integration_cloud resources, which was mistakenly removed in version 4.4.0

​

4.4.0

• Added aws configuration block to formal_integration_cloud resources, including template_version and s3_bucket_arn. See the CloudFormation Changelog for template version history.

• Provider now uses version 2.8.1 of the Formal Go SDK and version 2025-02-24 of the API
• The type field of formal_integration_cloud resources is now deprecated in favor of aws

​

4.3.2

• Bumped to version 2.7.0 of the Formal SDK

​

4.3.1

• Added encryption keys and log configurations resources

• Added deprecated notification for managed_tls field in formal_connector_hostname
• Deprecated managed_tls field in formal_connector_hostname

• Fixed the list of update-able resource fields for formal resources

​

4.3.0

• Added dns_record to formal_connector_hostname

• Removed ForceNew for formal_resource_hostname.hostname

​

4.2.2

• Added resource_hostname as supported identity type for native_user_link

​

4.2.1

• Added formal_resource_hostname resource

​

4.2.0

• Support for new form cloud integrations and log integrations