Configure a Terraform policy set with pre-written policies

As organizations adopt Terraform across multi-cloud environments, enforcing consistent security and compliance controls remains a major challenge. The policy-as-code approach in HCP Terraform requires deep expertise to author and enforce policies effectively.

HCP Terraform introduces a pre-written policy catalog that helps introduce best practices that secure infrastructure without writing or sourcing policies manually.

This topic shows how to create a policy set for Terraform policy using pre-written policies. If you want to use pre-written policies for Sentinel refer to Sentinel policy set with pre-written policies.

Prerequisites

• Terraform 1.16.0 or later in the workspace.
• HCP Terraform agent 1.28.10 or later when using customer-managed agents.
• Access to the pre-written policy catalog and Terraform policy beta.

Create new policy set

1. Sign in to HCP Terraform or Terraform Enterprise and navigate to your organization.

2. Choose Settings from the sidebar, then Policy sets.

3. Choose the Pre-written policies option.

4. Select Terraform policy.

5. From the table, select all policies you want to add to the policy set.

   1. Click on a policy name to view the policy details.
   2. Use the filter bar to search for specific policies.
   3. Select all desired policies.

6. Click on the Next button.

7. Use the ... button for each policy or the Actions dropdown to define the enforcement level for the selected policies. Available levels for Terraform policy are:

   • Advisory: Failed policies never interrupt the run. They provide information about policy check failures in the UI.
   • Mandatory overridable: Stops the operation if the conditions of the policy aren't met, but allows a user with appropriate permissions to override the policy and continue.
   • Mandatory: Failed policies stop the run, Terraform does not apply runs until a user fixes the issue that caused the failure.

   Refer to Policy enforcement levels for more information.

8. Click on the Next button.

9. Configure the policy set by adding:

   • Policy set name: a unique name for the policy set. You can use any combination of letters, numbers, -, and _. A name is required.
   • Policy set description: an optional description of the policy set behavior.
   • Scope of policies: the scope the HCP Terraform applies the policies to. Refer to Policy set scope for details.

10. Click Create policy set to finish.