Policy enforcement overview

This topic provides overview information about policies in HCP Terraform. Policies are rules that let you validate that Terraform plans comply with security rules and best practices. You can use Terraform policy with both workspaces and Stacks. Sentinel and OPA policy sets only support workspaces.

Introduction

You can implement policies using one of the following frameworks:

Terraform policy (beta): Native HCL-based policy framework
Sentinel: HashiCorp's policy-as-code framework
OPA: Open Policy Agent with Rego language

You can implement policies that check for any number of conditions, such as whether infrastructure configuration adheres to security standards or best practices. For example, you may want to write a policy to check whether Terraform plans to deploy production infrastructure to the correct region.

You can also use policies to enforce standards for your organization’s workflows. For example, you could write a policy to prevent new infrastructure deployments on Fridays, reducing the risk of production incidents outside of your team’s working hours.

Prerequisites

Policy enforcement for workspaces and Stacks

You can apply Terraform policy sets with both workspaces and Stacks, while Sentinel and OPA only support workspaces.

Workspaces: Policies evaluate during workspace runs. Refer to Policy enforcement in workspaces to learn how to manage and evaluate policies for workspaces.
Stacks: Policies evaluate per deployment in a Stack. Refer to Policy enforcement for Stacks to learn how to manage and evaluate policies for workspaces.

Terraform policy requires Terraform v1.16alpha or later. To enable alpha builds of Terraform, navigate to your organization's Settings page, select General from the left navigation, and enable the Show Terraform pre-releases setting.

Workflow

The following workflow describes how to create and manage policies manually. The policy configuration file format depends on your policy framework. Refer to the following topics for more information:

Author policies

You can author policies in the appropriate format for the policy framework of your choice, or implement pre-written Terraform policy or Sentinel policies created and maintained by HashiCorp. Pre-written policies enforce common standards, such as PCI DSS. Refer to Pre-written policy library #FIXME: Link to OOTB policies for information about publicly available pre-written policies.

For information about writing your own policies, refer to the appropriate documentation for the policy framework of your choice:

Create a policy set

Add a policy configuration file to a repository in your version control system (VCS), add policies, then connect them to your organization.

You can manually write custom policies in Sentinel or OPA framework format, or implement pre-written Sentinel policies created and maintained by HashiCorp. Pre-written Sentinal policies enforce common standards, such as PCI DSS. Refer to Pre-written policy library for information about publicly available pre-written policies. For information about writing custom Sentinel policies, refer to the Sentinel documentation.

You can apply policies globally or apply them to specific projects, workspaces, Stacks, or deployments. HCP Terraform checks the Terraform plan against the policy set during each run. A policy set can only contain policies written in a single policy framework, but you can apply multiple policy sets using different frameworks to the same workspace or Stack.

Although the UI allows you author and store policies in the application, we recommend storing policies in a VCS to implement a policy-as-code workflow, which ensures standardization, security, and auditability. You can also create policy sets programmatically using the API. Refer to Managing Policy Sets for details.

Review policy results

#FIXME: Stacks

HCP Terraform displays policy results for each policy set. Depending on their enforcement level, failed policies can stop the run. You can override failed policies with the right permissions.

For workspace-specific information about viewing policy results in the UI, refer to View policy results.