Terraform Advanced — Sentinel Policies

Policy as code for Terraform Cloud and Enterprise.

---

What is Sentinel?

HashiCorp’s policy-as-code framework. Runs between plan and apply:

terraform plan → Sentinel check → terraform apply
                   ↓ FAIL
                 Block apply

---

Enforcement Levels

Level	Behavior
advisory	Warn but allow
soft-mandatory	Block unless overridden by admin
hard-mandatory	Block always, no override

---

Example Policies

Require Tags

# require-tags.sentinel
import "tfplan/v2" as tfplan

required_tags = ["Environment", "Team", "CostCenter"]

main = rule {
    all tfplan.resource_changes as _, rc {
        rc.type in ["aws_instance", "aws_s3_bucket", "aws_vpc"] implies
        all required_tags as tag {
            rc.change.after.tags contains tag
        }
    }
}

Restrict Instance Types

# restrict-instance-types.sentinel
import "tfplan/v2" as tfplan

allowed_types = ["t3.micro", "t3.small", "t3.medium", "m5.large"]

main = rule {
    all tfplan.resource_changes as _, rc {
        rc.type is "aws_instance" implies
        rc.change.after.instance_type in allowed_types
    }
}

---

sentinel.hcl

policy "require-tags" {
  source            = "./require-tags.sentinel"
  enforcement_level = "hard-mandatory"
}

policy "restrict-instance-types" {
  source            = "./restrict-instance-types.sentinel"
  enforcement_level = "soft-mandatory"
}

💡 Production Tip: Sentinel is only available in Terraform Cloud/Enterprise. For open-source Terraform, use OPA/Conftest instead.

---

What’s Next?

Open-source policy enforcement with OPA.

← Vault Provider OPA & Conftest →