Terraform Enterprise policy enforcement overview

This topic provides overview information about policies in Terraform Enterprise. Policies are rules for Terraform runs that let you validate that Terraform plans comply with security rules and best practices. You can use Terraform policy with both workspaces and Stacks. Sentinel and OPA policy sets only support workspaces.

Hands-on: Try the Enforce Policy with Sentinel and Detect Infrastructure Drift and Enforce OPA Policies tutorials.

Introduction

You can implement policies using one of the following frameworks:

• Terraform policy: Native HCL-based policy framework
• Sentinel: HashiCorp's policy-as-code framework
• OPA: Open Policy Agent with Rego language

You can implement policies that check for any number of conditions, such as whether infrastructure configuration adheres to security standards or best practices. For example, you may want to write a policy to check whether Terraform plans to deploy production infrastructure to the correct region.

You can also use policies to enforce standards for your organization's workflows. For example, you could write a policy to prevent new infrastructure deployments on Fridays, reducing the risk of production incidents outside of your team's working hours.

Policy enforcement for workspaces and Stacks

You can apply Terraform policy sets with workspaces and Stacks. Sentinel and OPA only support workspaces.

• Workspaces: Policies evaluate during workspace runs. Refer to Policy enforcement in workspaces to learn how to manage and evaluate policies for workspaces.
• Stacks: Policies evaluate per deployment in a Stack. Refer to Policy enforcement for Stacks to learn how to manage and evaluate policies for Stacks.

Terraform policy requires Terraform 1.17.0 beta-1 or later. To enable alpha builds of Terraform, navigate to your organization's Settings page, select General from the left navigation, and enable the Show Terraform pre-releases setting.

Workflow

The following workflow describes how to create and manage policies manually.

Define policy

You can use the Terraform policy, Sentinel, or OPA framework to create custom policies. You can also use pre-written Sentinel policies created and maintained by HashiCorp.

Create and apply policy sets

Policy sets are collections of policies you can apply globally or to specific projects, workspaces, and Stacks in your organization. For each run in the selected workspaces, Terraform Enterprise checks the Terraform plan against the policy set.

You can also exclude specific workspaces from global or project-scoped policy sets. Terraform Enterprise won't enforce a policy set's policies on any runs in an excluded workspace. For example, if you attach a policy set to a project and then exclude one of the project's workspaces from that policy set, Terraform Enterprise will not enforce the policy set on the excluded workspace.

You can create policy sets from the user interface, the API, or by connecting Terraform Enterprise to your version control system. A policy set can only contain policies written in a single policy framework, but you can apply multiple policy sets using different frameworks to the same workspace or Stack.

Refer to Managing Policy Sets for details.

Review policy results

The Terraform Enterprise UI displays policy results for each policy set you apply to the workspace. Depending on their enforcement level, failed policies can stop the run. You can override failed policies with the right permissions.

Refer to Policy Results for details.