Policy as Code - Sentinel

Note

Sentinel policies and policy sets are authored and managed by platform operators — see the Administration Guide: Policy as code and Sentinel management.

Explanation of the policy enforcement workflow

The policy enforcement workflow with HashiCorp Sentinel is a structured process.

Organizations begin by defining policies that articulate the rules governing their infrastructure.
- Customers are advised to render their governance and compliance policies in such a way so that Sentinel policies are then authored to satisfy each.
- Doing so will enable your business to operationalize governance and controls through automated means.
- Typical policies customers start with include governance of maintenance windows protecting software components from adverse change at the wrong time, and enforcement of metadata tagging of cloud resources, and infrastructure-as-code style such as ensuring Terraform module versions are pinned and usable only from your organization's private registry.
The next step is to code the policy using the Sentinel language. See below for more on how code repositories are structured.
- Policies are arranged in sets.
- Policy sets are scoped to an entire organization or to one or more projects and/or workspaces in your HCP Terraform organization.
- Scoping policy sets at the project level allows policy enforcement to be integrated into self-service workflows, which typically create new workspaces on the fly then run them immediately. Any new self-service workspace will inherit the policy sets that are scoped to the parent project.
Sentinel is configured to operate according to the policies in the policy sets that are scoped to the running workspace.
- Depending on the enforcement level (advisory, soft- or hard-mandatory) of the policy, Sentinel will either allow or deny the apply phase of the workspace run.