We are excited to announce the publication of a new Writing and Testing Sentinel Policies for Terraform Enterprise Guide to our Resource Library. This comprehensive guide teaches you how to write and test governance policies that restrict the infrastructure provisioned by Terraform Enterprise. The guide includes many examples (for AWS, Google, and Azure) and five exercises that are carefully matched to the sections of the guide that precede them.
HashiCorp’s Sentinel is a language and framework that implements Policy as Code with fine-grained, logic-based policy decisions just as HashiCorp’s Terraform implements Infrastructure as Code. Terraform Enterprise (TFE) enforces Sentinel policies between the plan and apply stages of runs, ensuring that resources can only be created or modified if all policies checked against them pass or are overridden by authorized users. Using Sentinel policies is much more reliable than using policy spreadsheets since the policies are codified and executed as part of your provisioning pipeline.
The following useful Sentinel concepts are covered in the guide: rules, for loops, any/all expressions, set operators, comparison operators, logical operators, the matches operator (which does regex comparisons), the else operator (which avoids undefined expressions), the built-in length function, the strings import, and the types import.
The guide also shows you how to use the Sentinel print function to debug errors in Sentinel policies as you are writing and testing them.
There are three primary types of Sentinel policies in Terraform Enterprise, corresponding to the three types of Sentinel imports: tfplan, tfstate, and tfconfig. The guide includes a basic four-step methodology for restricting the attributes of Terraform resources with the tfplan import.
The four steps of the methodology are:
The guide also shows you how to use the Sentinel Simulator to test your TFE Sentinel policies with TFE Sentinel mocks without actually running your Terraform code on a TFE server. The mocks give Sentinel data that simulate what an actual terraform plan would provide. There are three kinds of TFE Sentinel mocks, corresponding to the three TFE Sentinel imports. The guide gives an example of using the tfconfig mock.
We are excited to share this guide with our users. For more on Sentinel see our docs and the Governance section of our terraform-guides repository.
No-code provisioning module version upgrades are now GA in HCP Terraform, providing validated self-service infrastructure to reduce toil and lower cloud spend.
Do cloud right with The Infrastructure Cloud from HashiCorp. Unlock developer potential while controlling cloud costs and risk.
A recap of HashiCorp infrastructure and security news and developments from Google Cloud Next, from scaling infrastructure as code to fighting secrets sprawl and more.