Overview

Hand-written YAML data models are easy to get subtly wrong — a typo, a missing field, or a value that violates an organization’s naming or design standards often isn’t caught until a terraform plan fails, or worse, until a non-compliant change reaches production. nac-validate catches both classes of error up front: syntax and schema mistakes, and semantic/business-rule violations against custom validation rules — before the data model is ever consumed by downstream tooling.

$ nac-validate --help

Usage: nac-validate [OPTIONS] [PATHS]...

A CLI tool to perform syntactic and semantic validation of YAML files.

Arguments:
  [PATHS]...            List of paths pointing to YAML files or directories

Options:
  -v, --verbosity [DEBUG|INFO|WARNING|ERROR|CRITICAL]
                        Verbosity level [env: NAC_VALIDATE_VERBOSITY] [default: WARNING]
  -s, --schema FILE     Path to schema file [env: NAC_VALIDATE_SCHEMA] [default: .schema.yaml]
  -r, --rules DIRECTORY Path(s) to directories with semantic validation rules (repeatable)
                        [env: NAC_VALIDATE_RULES]
  -o, --output FILE     Write merged content from YAML files to a new YAML file
                        [env: NAC_VALIDATE_OUTPUT]
  --non-strict          Accept unexpected elements in YAML files
                        [env: NAC_VALIDATE_NON_STRICT]
  -f, --format [text|json]
                        Output format for validation results
                        [env: NAC_VALIDATE_FORMAT] [default: text]
  --no-color            Disable colored output [env: NO_COLOR]
  --compact             Use compact output format without rule context details
                        [env: NAC_VALIDATE_COMPACT]
  --version             Display version number
  --list-artifacts      List the effective schema, artifact layers and validation rules and exit
  --artifacts / --no-artifacts
                        Experimental: also load schema and rules from bundles in nac/bundles/
                        and the installed Terraform module, applying nac/overrides.yaml.
                        Off by default (implied by --bundle and --module-dir); will become
                        the default in a future version [env: NAC_VALIDATE_ARTIFACTS]
  --bundle PATH         Experimental: path to an artifact bundle (zip, tar.gz or directory),
                        repeatable; implies --artifacts. Defaults to every .zip, .tar.gz or
                        .tgz file and directory in nac/bundles/ [env: NAC_VALIDATE_BUNDLE]
  --module-dir DIRECTORY
                        Experimental: path to a module directory containing nac/ artifacts;
                        implies --artifacts. Defaults to the module discovered via
                        terraform init [env: NAC_VALIDATE_MODULE_DIR]
  --help                Show this message and exit

How It Works

Validation runs in two stages. Each stage only runs if the previous one passed:

1. Syntactic validation: every YAML file in the given paths is parsed and validated on its own against a Yamale schema (--schema), which defines the allowed keys, types and values. nac-validate extends Yamale with additional constraints, such as primary keys that must be unique within a list. See Schema Validation.
2. Semantic validation: all YAML files are merged into a single data model, which is checked by a set of rules implemented in Python (--rules). Rules cover what a schema cannot express, such as references between objects or organization-specific standards. See Semantic Validation.

The result is reported as text or JSON, with an exit code indicating which stage failed. Running the tool, the input data handling and the output are described in Usage.