Sentinel policy as code in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Sentinel Policy Enforcement

What happens when a Sentinel policy denies a Terraform plan?

A Terraform ignores the policy and proceeds with the apply operation.

B Terraform applies the changes but logs a warning about the policy denial.

C Terraform blocks the apply operation and does not make any infrastructure changes.

D Terraform automatically modifies the plan to comply with the policy and applies it.

💡 Hint

Think about what 'policy enforcement' means in terms of control.

When a Sentinel policy denies a plan, Terraform blocks the apply operation to prevent non-compliant changes.

❓ Configuration

intermediate

Sentinel Policy to Restrict AWS Instance Types

Which Sentinel policy code correctly denies any AWS EC2 instance with type 't2.micro'?

Terraform

import "tfplan/v2"

main = rule {
  all tfplan.resources.aws_instance as _, instances {
    all instances as _, instance {
      instance.applied.instance_type != "t2.micro"
    }
  }
}

A

import "tfplan/v2"

main = rule {
  all tfplan.resources.aws_instance as _, instances {
    any instances as _, instance {
      instance.applied.instance_type == "t2.micro"
    }
  }
}

B

import "tfplan/v2"

main = rule {
  all tfplan.resources.aws_instance as _, instances {
    all instances as _, instance {
      instance.applied.instance_type != "t2.micro"
    }
  }
}

C

}
}  
}    
"orcim.2t" =! epyt_ecnatsni.deilppa.ecnatsni      
{ ecnatsni ,_ sa secnatsni lla    
{ secnatsni ,_ sa ecnatsni_swa.secruoser.nalpft lla  
{ elur = niam

"2v/nalpft" tropmi

D

import "tfplan/v2"

main = rule {
  any tfplan.resources.aws_instance as _, instances {
    any instances as _, instance {
      instance.applied.instance_type != "t2.micro"
    }
  }
}

💡 Hint

Look for the correct operator to check inequality and the correct quantifiers to deny 't2.micro'.

The policy uses 'all' to ensure no instance is 't2.micro' and '!=' operator for inequality in Sentinel.

❓ Architecture

advanced

Sentinel Policy Integration in Terraform Cloud Workflow

In a Terraform Cloud workspace with Sentinel policies enabled, what is the correct order of events when a user runs terraform apply?

A 1,2,4,3

B 1,3,2,4

C 2,1,3,4

D 1,2,3,4

💡 Hint

Think about the natural flow from user action to policy evaluation to final apply.

The user triggers apply, Terraform Cloud creates a plan, sends it to Sentinel, then applies or blocks based on policy.

❓ security

advanced

Sentinel Policy to Enforce Tagging on Resources

Which Sentinel policy snippet correctly enforces that all resources have a non-empty 'Environment' tag?

A

import "tfplan/v2"

main = rule {
  all tfplan.resources as _, instances {
    all instances as _, instance {
      instance.applied.tags.Environment is string and instance.applied.tags.Environment != ""
    }
  }
}

B

import "tfplan/v2"

main = rule {
  all tfplan.resources as _, instances {
    any instances as _, instance {
      instance.applied.tags.Environment is string and instance.applied.tags.Environment != ""
    }
  }
}

C

import "tfplan/v2"

main = rule {
  any tfplan.resources as _, instances {
    all instances as _, instance {
      instance.applied.tags.Environment is string and instance.applied.tags.Environment != ""
    }
  }
}

D

import "tfplan/v2"

main = rule {
  all tfplan.resources as _, instances {
    all instances as _, instance {
      instance.applied.tags.Environment != null
    }
  }
}

💡 Hint

Check for correct use of 'all' quantifiers and string checks.

Option A ensures every resource and instance has a non-empty string 'Environment' tag, enforcing tagging strictly.

❓ service_behavior

expert

Behavior of Sentinel Policy with Multiple Rules

Given a Sentinel policy with multiple rules where main is defined as main = rule1 and rule2, what is the behavior if rule1 passes but rule2 fails?

A The policy fails because all rules combined with 'and' must pass.

B The policy passes because at least one rule passed.

C The policy result is undefined and depends on Terraform Cloud settings.

D The policy passes but logs a warning about the failed rule.

💡 Hint

Consider how logical AND works in boolean expressions.

When rules are combined with 'and', all must pass for the policy to pass. If any fail, the policy fails.