We’re excited to announce a new set of pre-written Sentinel policies for AWS designed to support ISO/IEC 27001 compliance. These policy sets aim to lower the barrier to adopting policy as code while helping organizations align their Terraform-managed AWS resources with globally recognized security standards. Co-created and co-owned by HashiCorp and AWS, these policies map to key ISO 27001 Annex A controls and are now available for use in the Terraform Registry.
»A collaborative and continued effort
While Sentinel is a powerful tool for enforcing cloud governance at scale, adopting a policy-as-code model can be complex and resource-intensive. Many organizations face challenges due to limited expertise or the time required to translate compliance frameworks into enforceable policies from scratch.
To help address these challenges, AWS and HashiCorp have worked closely to simplify hybrid-cloud governance and compliance. Building on previous releases aligned to frameworks such as CIS and AWS Foundational Security Best Practices (FSBP), we are excited to introduce a new set of pre-written Sentinel policies designed to help organizations meet ISO/IEC 27001 requirements across AWS environments. These policies map to key ISO 27001 Annex A controls—covering areas such as access control, cryptography, logging and monitoring, and secure configuration management.
With hundreds of policies now available, organizations can adopt a secure-by-default posture for AWS infrastructure without having to start from scratch. These policy sets provide a strong foundation, reducing the need for manual policy development and helping teams consistently enforce governance controls across their cloud environments.
»Getting started with pre-written Sentinel policies
Please refer to our pre-written policy library documentation to get started with pre-written Sentinel policies for ISO 27001, or check out the other pre-written Sentinel policy sets available in the Terraform registry:
Pre-written Sentinel Policies for AWS CIS Foundations Benchmarking
Pre-written Sentinel Policies for AWS Foundational Security Best Practices (FSBP)
Pre-written Sentinel Policies for AWS NIST SP 800-53 Revision 5
New to Terraform? Get started with HashiCorp-managed HCP Terraform to begin provisioning and managing your infrastructure in any environment. And don’t forget to link your HCP Terraform and HashiCorp Cloud Platform (HCP) accounts for a seamless sign-in experience.
