Terraform Foundational Policies using Sentinel
Step-01: Introduction¶
- Terraform Foundational Policies Library
- This repository contains a library of policies that can be used within Terraform Cloud to accelerate your adoption of policy as code.
- This is pre-built sentinel policies provided by Terraform
Step-02: Review sentinel.hcl¶
- Terraform Foundational Policies using Sentinel
- Terraform Sentinel Azure CIS Networking Policies
- Folder Name: terraform-sentinel-cis-policies
policy "azure-cis-6.1-networking-deny-public-rdp-nsg-rules" { source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.1-networking-deny-public-rdp-nsg-rules/azure-cis-6.1-networking-deny-public-rdp-nsg-rules.sentinel" enforcement_level = "advisory" } policy "azure-cis-6.2-networking-deny-public-ssh-nsg-rules" { source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.2-networking-deny-public-ssh-nsg-rules/azure-cis-6.2-networking-deny-public-ssh-nsg-rules.sentinel" enforcement_level = "advisory" } policy "azure-cis-6.3-networking-deny-any-sql-database-ingress" { source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.3-networking-deny-any-sql-database-ingress/azure-cis-6.3-networking-deny-any-sql-database-ingress.sentinel" enforcement_level = "advisory" } policy "azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period" { source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period/azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period.sentinel" enforcement_level = "advisory" }
Step-03: Copy Sentinel CIS Policies to terraform-sentinel-policies git repo¶
- Copy folder
terraform-sentinel-cis-policiesto Local git repositoryterraform-sentinel-policies-azure - Check-In code to Remote Repository
Step-04: Add new Sentinel Policy Set in Terraform Cloud¶
- Go to Terraform Cloud -> Organization (hcta-azure-demo1) -> Settings -> Policy Sets
- Click on Connect a new Policy Set
- Use existing VCS connection from previous section github-terraform-modules which we created using OAuth App concept
- Choose Repository: terraform-sentinel-policies-azure.git
- Name: terraform-sentinel-cis-policies
- Description: terraform sentinel cis-policies
- Policies Path: terraform-sentinel-cis-policies
- Scope of Policies: Policies enforced on selected workspaces
- Workspaces: terraform-cloud-azure-demo1
- Click on Connect Policy Set
Step-05: Review our first Terraform Cloud Workspace¶
- Go to Terraform Cloud -> Organization (hcta-azure-demo1) -> workspace (terraform-cloud-azure-demo1)
- Queue Plan -> CIS-Policy-Test-1
- Verify the following
- Plan
- Cost Estimate
- Policy Check: Verify what all passed and failed
- Finally, Disacrd the Run
References¶
🎉 New Course
Ultimate DevOps Real-World Project Implementation on AWS
$15.99
$84.99
81% OFF
MARCH2026
Enroll Now on Udemy →
🎉 Offer