We are excited to announce the publication of a new Writing and Testing Sentinel Policies for Terraform Enterprise Guide to our Resource Library. This comprehensive guide teaches you how to write and test governance policies that restrict the infrastructure provisioned by Terraform Enterprise. The guide includes many examples (for AWS, Google, and Azure) and five exercises that are carefully matched to the sections of the guide that precede them.
HashiCorp’s Sentinel is a language and framework that implements Policy as Code with fine-grained, logic-based policy decisions just as HashiCorp’s Terraform implements Infrastructure as Code. Terraform Enterprise (TFE) enforces Sentinel policies between the plan and apply stages of runs, ensuring that resources can only be created or modified if all policies checked against them pass or are overridden by authorized users. Using Sentinel policies is much more reliable than using policy spreadsheets since the policies are codified and executed as part of your provisioning pipeline.
The following useful Sentinel concepts are covered in the guide: rules, for loops, any/all expressions, set operators, comparison operators, logical operators, the matches operator (which does regex comparisons), the else operator (which avoids undefined expressions), the built-in length function, the strings import, and the types import.
The guide also shows you how to use the Sentinel print function to debug errors in Sentinel policies as you are writing and testing them.
There are three primary types of Sentinel policies in Terraform Enterprise, corresponding to the three types of Sentinel imports: tfplan, tfstate, and tfconfig. The guide includes a basic four-step methodology for restricting the attributes of Terraform resources with the tfplan import.
The four steps of the methodology are:
The guide also shows you how to use the Sentinel Simulator to test your TFE Sentinel policies with TFE Sentinel mocks without actually running your Terraform code on a TFE server. The mocks give Sentinel data that simulate what an actual terraform plan would provide. There are three kinds of TFE Sentinel mocks, corresponding to the three TFE Sentinel imports. The guide gives an example of using the tfconfig mock.
We are excited to share this guide with our users. For more on Sentinel see our docs and the Governance section of our terraform-guides repository.
Customers can now deploy Terraform Enterprise using Podman on Red Hat Enterprise Linux. Recent releases also improve VCS, policy, and run task workflows at scale.
Golden patterns for infrastructure and security automation workflows lie at the core of The Infrastructure Cloud. Here’s how to implement them using HashiCorp Cloud Platform services.
Learn about Terraform features that can optimize cloud spending at every stage of growth.