In this blog post, I will show you how to implement Policy-as-Code (PaC) to your Terraform workflow using Hashicorp Sentinel. PaC is a way of defining and enforcing policies for your infrastructure as code, which can help you ensure compliance, security and best practices across your organization. Sentinel is a language and framework for writing and applying policies to Terraform and other Hashicorp products.
Why use Policy-as-Code?
Policy-as-Code has many benefits for managing your infrastructure as code. Some of them are:
- It allows you to codify your policies and store them in version control, which makes them easier to track, review and audit.
- It enables you to apply your policies consistently and automatically across your environments, which reduces human errors and increases efficiency.
- It empowers you to enforce your policies at different stages of your workflow, such as plan, apply or destroy, which gives you more control and visibility over your infrastructure changes.
- It supports you to write policies that are flexible and expressive, which can handle complex scenarios and logic.
How to use Sentinel with Terraform?
Sentinel integrates seamlessly with Terraform Cloud and Terraform Enterprise, which are platforms for collaborating and automating your Terraform workflows. To use Sentinel with Terraform, you need to:
- Write your policies in Sentinel language and save them as .sentinel files in your repository.
- Configure your Terraform organization and workspace to enable Sentinel and specify which policies to apply.
- Run your Terraform commands as usual and see how Sentinel evaluates your policies against your configuration and state.
Sentinel policies can be applied at different levels of granularity, such as organization, workspace or run. You can also use different enforcement modes, such as advisory, soft-mandatory or hard-mandatory, depending on how strict you want your policies to be.
- Advisory: Failed policies never interrupt the run, just post a warning.
- Soft-mandatory: lets an organization owner or a user with override privileges proceed with the run in the event of failure. Terraform Cloud logs all overrides.
- Hard-mandatory: requires that the policy passes. If a policy fails, the run stops. You must resolve the failure to proceed.
Learn more about Sentinel: Introduction to Sentinel, HashiCorp Policy as Code Framework By Armon Dadgar, CTO Hashicorp.
Terraform without Sentinel:
Terraform with Sentinel:
We are using a policy to restrict VM size, which basically means that if the VM size mentioned in our infrastructure matches the list VM sizes mentioned in our policy, then the Policy checks will pass and proceed to Apply phase, otherwise it will stop with the error.
And we are adding this policy directly to Terraform Cloud via UI.
So, finally we are done with adding our sentinel policy to Terraform Cloud.
It's time to check the workflow.
So, in our infra, we have used VM with size, "Standard_D1_v2", which is a part of allowed VM sizes, so let's see the workflow outcome.
We can that we have new phase named as 'Sentinel policies passed', and since the infra matches the policy condition it passes and proceeded to Apply phase.
Let's try with some different VM size.
We are changing the VM size to "Standard_D2_v5" which is not a part of allowed VM sizes, and running the workflow.
We can see that the sentinel policy phase failed and stop the workflow there itself because we applied enforcement mode as hard-mandatory.
Error message: Resource azurerm_virtual_machine.vm[0] has attribute vm_size with value Standard_D2_v5 that is not in the allowed list: ["Standard_A1" "Standard_A2" "Standard_D1_v2" "Standard_D2_v2"]
Let's me just give you a small brief that how the policies are working. So, the Plan phase generates the mock files (containing the output of Plan phase) which is used as input to Sentinel policy phase, and then the policy phase checks with the policy and accordingly pass or fail.
You can even download those mock files to see the results.
If you want to learn how to use Terraform Cloud to deploy over Azure, checkout this blog:
You can get the whole Policy-as-Code from this repo:
This Project uses Terraform Sentinel to apply Policy-as-Code on Terraform Workflow. Get more details:
Implementing Policy-as-Code to Terraform workflow using Hashicorp Sentinel
In this project, we are implementing Policy-as-Code (PaC) to our Terraform workflow using Hashicorp Sentinel. PaC is a way of defining and enforcing policies for your infrastructure as code, which can help you ensure compliance, security and best practices across your organization. Sentinel is a language and framework for writing and applying policies to Terraform and other Hashicorp products.
Why use Policy-as-Code?
Policy-as-Code has many benefits for managing your infrastructure as code. Some of them are:
- It allows you to codify your policies and store them in version control, which makes them easier to track, review and audit.
- It enables you to apply your policies consistently and automatically across your environments, which reduces human errors and increases efficiency.
- It empowers you to enforce your policies at different stages of your workflow, such as plan, apply or destroy, which gives you more control…
Share if your like the blog and follow for more!!
