0Pricing
DevOps Bootcamp · Lesson

Sentinel Policies for Governance

Learn to write and enforce policy-as-code using HashiCorp Sentinel to ensure compliance and governance across your Terraform deployments.

Sentinel Policies for Governance is a free DevOps Bootcamp lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Policy-as-Code & Sentinel Intro

What if you could automatically ensure your infrastructure deployments meet certain rules? That's the power of Policy-as-Code (PaC). PaC defines rules for infrastructure creation and modification in a programmable way, bringing governance into your development workflow. HashiCorp Sentinel is a powerful PaC framework designed for this purpose.

Sentinel's Role with Terraform

Sentinel integrates directly with Terraform Cloud and Terraform Enterprise. It acts as a gatekeeper, evaluating your Terraform execution plan before any changes are applied to your cloud environment. This crucial step prevents non-compliant or insecure infrastructure from ever being provisioned, enforcing rules proactively.

Policies & Enforcement Levels

A Sentinel policy is a set of rules written in the Sentinel language. When a policy is triggered, it returns true (pass) or false (fail). Policies can be configured with different enforcement levels:

  • Advisory: Warns about violations but allows the operation to proceed.
  • Soft-Mandatory: Requires an explicit override to proceed with non-compliant changes.
  • Hard-Mandatory: Blocks non-compliant operations entirely, requiring policy adherence.

Sentinel Policy Structure

Sentinel policies are defined in .sentinel files. They typically include imports, rules, and a main condition. The main rule determines the policy's pass/fail outcome.

A basic policy might look like this:

import "tfplan"

main = rule {
  tfplan.resource_changes is empty
}

Accessing Terraform Plan Data

The tfplan import provides a structured view of the Terraform execution plan. Policies use this data to inspect:

  • tfplan.resource_changes: Details on resources being created, updated, or deleted.
  • tfplan.variables: Input variables provided to the configuration.
  • tfplan.outputs: Output values from the configuration.

This data is crucial for making informed policy decisions based on what Terraform intends to do.

Example: Deny Non-Approved Regions

Let's write a Sentinel policy to ensure all AWS resources are deployed only in us-east-1. This policy checks the region configured for each AWS resource in the plan.

import "tfplan/v2" as tfplan

allowed_regions = ["us-east-1"]

is_region_allowed = func(resource_change) {
  if resource_change.provider.name is "aws" {
    region = resource_change.provider.config.region else "us-east-1"
    return region in allowed_regions
  }
  return true # Not an AWS resource, allow
}

all_regions_compliant = all tfplan.resource_changes as _, rc {
  is_region_allowed(rc)
}

main = rule {
  all_regions_compliant
}

Policy Functions and Operators

Sentinel provides powerful built-in functions and operators for complex logic:

  • Collection Functions: all, any, filter, map for iterating over lists/maps.
  • Type Functions: is, type_of for checking data types.
  • Operators: Logical (and, or, not) and comparison (==, !=, >, <).

These help you build robust and expressive policies to cover various scenarios.

Example: Enforce Required Tags

A common governance requirement is to enforce specific tags on resources for cost allocation or identification. This policy ensures that all new or updated aws_instance resources have a Project tag.

import "tfplan/v2" as tfplan

required_tags = ["Project"]

resource_has_required_tags = func(resource_change) {
  if resource_change.type is "aws_instance" {
    # Check if 'tags' attribute exists in the planned state
    if not ("tags" in resource_change.change.after) {
      return false
    }
    
    missing_tags = filter required_tags as tag {
      not (tag in resource_change.change.after.tags)
    }
    return missing_tags is empty
  }
  return true # Not an aws_instance, allow
}

all_instances_tagged = all tfplan.resource_changes as _, rc {
  (rc.change.actions contains "create" or rc.change.actions contains "update") ?
    resource_has_required_tags(rc) :
    true # Only check on create/update actions
}

main = rule {
  all_instances_tagged
}

Local Policy Testing

Before deploying policies to Terraform Cloud/Enterprise, you can test them locally using the Sentinel CLI. The sentinel test command allows you to define test cases with mock tfplan data. This helps you verify policy behavior and catch errors early, ensuring your policies work as intended without affecting live environments.

Policy Logic Check

You need to create a Sentinel policy that prevents any AWS S3 bucket from being created with public read access. Which specific part of the tfplan data would you primarily inspect to enforce this?

Recap: Governance with Sentinel

We've explored HashiCorp Sentinel, a powerful policy-as-code framework for governance:

  • It integrates with Terraform Cloud/Enterprise to enforce rules.
  • Policies evaluate the tfplan before infrastructure is applied.
  • Different enforcement levels (advisory, soft, hard) control policy impact.
  • You can write policies to deny regions, enforce tags, and much more.
  • Local testing ensures policies work as intended before deployment.

Sentinel is key for maintaining compliance, security, and operational standards across your infrastructure deployments.

Frequently asked questions

Is the “Sentinel Policies for Governance” lesson free?

Yes — the full text of “Sentinel Policies for Governance” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Sentinel Policies for Governance”?

Learn to write and enforce policy-as-code using HashiCorp Sentinel to ensure compliance and governance across your Terraform deployments. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Sentinel Policies for Governance” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Multi-Cloud and Hybrid Cloud Patterns
  2. Sentinel Policies for Governance
  3. Terraform Cloud and Enterprise
  4. Building Custom Providers
← Back to DevOps Bootcamp