Your Sentinel and OPA policies represent years of work: security and compliance decisions, edge cases, and lessons learned, all captured as code. As infrastructure has evolved, governance increasingly depends on how resources relate, on external context, and on the full infrastructure lifecycle.
With the general availability of Terraform policy, a declarative, HCL-based policy as code framework integrated with Terraform, teams can enforce governance in the same language and workflows they already use to manage infrastructure.
The hard part is getting there. Converting policies manually means re-reading their logic, mapping it to Terraform resources and attributes, and writing and testing new policies across an entire library.
Today, we are announcing the general availability of the Terraform policy agent, which converts existing Sentinel and Open Policy Agent (OPA) policies into Terraform policies. For each policy, it generates a policy file, tests, and reports describing the conversion and any limitations. It runs as a container from Docker Hub, and you choose the model provider: GitHub Copilot, Amazon Bedrock, or LiteLLM.
»Why bring your policies to Terraform policy
Terraform policy builds on what Sentinel and OPA started, bringing policy closer to the infrastructure it governs. Teams moving to it gain:
Familiar, integrated authoring. Write policies in HCL, the language you already use, within your existing Terraform workflows.
Resource relationships. Evaluate how resources interact, such as requiring every IAM role to have a policy attached.
External context. Use provider data source lookups to bring organizational standards into policy decisions.
Provider and module controls. Block unapproved downloads to help reduce supply chain risk.
Lifecycle evaluation. Validate infrastructure before and after deployment, based on actual state.
»Three ways to get Terraform policies
You can build a working set of Terraform policies in three ways, depending on your requirements:
Pre-written policies: Start with HashiCorp-managed policies in HCP Terraform for established compliance frameworks across AWS, Azure, and Google Cloud, without having to author them yourself. Learn more
Custom authoring: Create policies for requirements that aren't covered by the pre-written catalogue. HashiCorp agent skills help coding agents write and test Terraform policies.
Conversion: Bring existing policy logic forward by converting policies written in Sentinel or OPA into Terraform policy.
»Introducing the Terraform policy agent
Conversion is not a line-by-line translation. Sentinel and OPA express policy logic differently from Terraform policy, so the agent works from the intent of each policy and builds and tests a Terraform policy designed to enforce that intent.
You can provide a Sentinel (.sentinel) or OPA (.rego) policy, a list of files, or an entire policy repository.
The agent follows a staged workflow:
Extract policy goals: Identify each policy's goals and translate them into plain language requirements you can review before any code is generated.
Generate policy and tests: Create the Terraform policy (.policy.hcl), tests (.policytest.hcl), supporting Terraform configuration, and a conversion report for each policy.
Validate and summarize: Run the generated tests and summarize the results for every policy.
Terraform policy agent architecture
»Grounded policy generation and better test coverage
The agent grounds its policies in real Terraform provider data, using the Terraform MCP server to look up schemas and validate resources and attributes. We tested conversions with AWS, Azure, and Google Cloud policies. Other providers in the Terraform Registry can be processed through schema lookups but are less tested, so review them carefully.
If your Sentinel policies include mock files, the agent also reads them after generating its first test scenarios and adds cases not already covered, so converted tests preserve scenarios from your existing implementation.
»Built for verification and review
A converted policy is only useful if you can review and validate what it enforces. That's why the workflow is designed around verification and human review.
Verified by real tools. The agent validates its output with Terraform and runs the generated tests. Reports show actual results, including passed and failed test cases per policy. We also evaluate the agent against a pinned set of real Sentinel policies to catch regressions.
Limitations are called out. Each report records known limitations, such as constructs with no Terraform policy equivalent, which may need manual follow-up.
You stay in control. You review what the agent understood at the requirements step and inspect a report for every run. Nothing is published to HCP Terraform or elsewhere.
»What to expect
The agent accelerates conversion but doesn't replace the review. Output is generated by a language model, so results can vary between runs. Passing generated tests shows a policy meets the generated scenarios, not that it is fully equivalent to the original Sentinel or OPA policy. Review each policy and run tfpolicy test, start with advisory enforcement, and move to mandatory once you have validated the behavior.
Your policy content is sent to the model provider you configure, so choose one that meets your organization's data and security requirements.
»Get started with a faster path to Terraform policy
To get started, pull the image from Docker Hub and follow the README to configure the agent and your model provider. Explore the Terraform policy documentation to learn the format, and the native pre-written policy experience for shared compliance baselines.
Share which policies convert well and where you hit limitations through issues in the Terraform policy agent repository.
