Policy enforcement overview

This topic provides overview information about policies in HCP Terraform. Policies are rules that let you validate that Terraform plans comply with security rules and best practices. You can use Terraform policy with both workspaces and Stacks. Sentinel and OPA policy sets only support workspaces.

Introduction

You can implement policies using one of the following frameworks:

Terraform policy: Native HCL-based policy framework
Sentinel: HashiCorp's policy-as-code framework
OPA: Open Policy Agent with Rego language

You can implement policies that check for any number of conditions, such as whether infrastructure configuration adheres to security standards or best practices. For example, you may want to write a policy to check whether Terraform plans to deploy production infrastructure to the correct region.

You can also use policies to enforce standards for your organization’s workflows. For example, you could write a policy to prevent new infrastructure deployments on Fridays, reducing the risk of production incidents outside of your team’s working hours.

Policy enforcement for workspaces and Stacks

You can apply Terraform policy sets with both workspaces and Stacks, while Sentinel and OPA only support workspaces.

Workspaces: Policies evaluate during workspace runs. Refer to Policy enforcement in workspaces to learn how to manage and evaluate policies for workspaces.
Stacks: Policies evaluate per deployment in a Stack. Refer to Policy enforcement for Stacks to learn how to manage and evaluate policies for workspaces.

Terraform policy requires Terraform v1.17 or later.

Workflow

The following workflow describes how to create and manage policies manually or use the catalog of pre-written policies maintained by HashiCorp. The policy configuration file format depends on your policy framework. Refer to the following topics for more information:

Author policies manually

You can author policies in the appropriate format for the policy framework of your choice.

For information about writing your own policies, refer to the appropriate documentation for the policy framework of your choice:

Although the UI allows you to author and store policies in the application, we recommend storing policies in a VCS to implement a policy-as-code workflow, which ensures standardization, security, and auditability. You can also create policy sets programmatically using the API. Refer to Managing Policy Sets for details.

Create a policy set with pre-written policies

You can implement pre-written policies created and maintained by HashiCorp. Pre-written policies enforce common standards, such as PCI DSS. Refer to Pre-written policy library for information about publicly available pre-written policies.

Pre-written policy sets that use the Terraform policy framework can apply to workspaces and Stacks. Pre-written policy sets that use Sentinel only support workspaces.

For information about using pre-written policies, refer to the appropriate documentation for the policy framework of your choice:

Create a policy set with a VCS repository

Add a policy configuration file to a repository in your version control system (VCS), add policies, then connect them to your organization.

You can manually write custom policies in Terraform policy, Sentinel, or OPA framework format. For information about writing custom Sentinel policies, refer to the Sentinel documentation.

You can apply policies globally or apply them to specific projects, workspaces, Stacks, or deployments. HCP Terraform checks the Terraform plan against the policy set during each run. A policy set can only contain policies written in a single policy framework, but you can apply multiple policy sets using different frameworks to the same workspace or Stack.

Review policy results

HCP Terraform enforces policies on Stacks configurations during each deployment operation. When you configure a policy set to target a Stack, HCP Terraform evaluates the policies against the Terraform plan for each deployment in the Stack.

HCP Terraform displays policy results for each policy set. Depending on their enforcement level, failed policies can stop the run. You can override failed policies with the right permissions.

For workspace-specific information about viewing policy results in the UI, refer to View policy results.