Sentinel policy as code in Terraform - Mini Project: Build & Apply

Sentinel Policy as Code with Terraform

📖 Scenario: You are working in a cloud team that uses Terraform to manage infrastructure. Your team wants to enforce a policy that limits the size of virtual machines (VMs) to control costs. You will write a Sentinel policy as code to check Terraform plans and ensure no VM exceeds a specified size.

🎯 Goal: Build a Sentinel policy that reads Terraform plan data and enforces a maximum VM size limit. This policy will help your team automatically prevent deploying VMs larger than allowed.

📋 What You'll Learn

Create a Sentinel policy file with a variable for maximum VM size

Access Terraform plan resource data in the policy

Write a rule that checks VM sizes against the maximum allowed

Return a boolean result indicating if the plan passes the policy

💡 Why This Matters

🌍 Real World

Sentinel policies help teams enforce rules automatically before infrastructure changes are applied, reducing errors and cost overruns.

💼 Career

Cloud engineers and DevOps professionals use Sentinel policies to implement governance and compliance in infrastructure as code workflows.

1

Create the Sentinel policy file with max VM size variable

Create a Sentinel policy file named vm_size_policy.sentinel. Define a variable called max_vm_size and set it to the string "Standard_DS2_v2".

Terraform

# Your code here

Hint

Use the syntax variable_name = "value" to define variables in Sentinel.

2

Import Terraform plan data and select VM resources

Add a block to import the Terraform plan data using import "tfplan/v2". Then create a variable called vms that selects all resources of type azurerm_virtual_machine from the planned values.

Terraform

max_vm_size = "Standard_DS2_v2"
# Your code here

Hint

Use import "tfplan/v2" as tfplan to access Terraform plan data. Then access VM resources with tfplan.planned_values.resources["azurerm_virtual_machine"].

3

Write a rule to check VM sizes against max_vm_size

Write a rule named vm_size_check that returns true only if all VMs in vms have their attributes.vm_size less than or equal to max_vm_size in lexicographical order. Use a for loop with variables vm to iterate over vms.

Terraform

max_vm_size = "Standard_DS2_v2"
import "tfplan/v2" as tfplan

vms = tfplan.planned_values.resources["azurerm_virtual_machine"]

# Your code here

Hint

Use rule { all vm in vms as vm { condition } } to check all VMs meet the size condition.

4

Return the final policy result

Add a main rule that returns the result of vm_size_check. This will be the final policy result.

Terraform

max_vm_size = "Standard_DS2_v2"
import "tfplan/v2" as tfplan

vms = tfplan.planned_values.resources["azurerm_virtual_machine"]

vm_size_check = rule {
    all vm in vms as vm {
        vm.instances[0].attributes.vm_size <= max_vm_size
    }
}

# Your code here

Hint

The main rule is the entry point and should return the result of your checks.

Practice

1. What is the main purpose of a Sentinel policy in Terraform?

easy

A. To enforce rules that control changes to cloud infrastructure

B. To write Terraform configuration files

C. To deploy cloud resources automatically

D. To monitor cloud resource usage

Solution

1. Step 1: Understand Sentinel policy role

   Sentinel policies are designed to enforce rules and guardrails on infrastructure changes.

2. Step 2: Differentiate from other Terraform tasks

   Writing configs and deploying resources are Terraform tasks, not Sentinel's role.

3. Final Answer:

   To enforce rules that control changes to cloud infrastructure -> Option A

4. Quick Check:

   Sentinel policy = enforce rules [OK]

Hint: Sentinel = rules to control changes, not deployment [OK]

Common Mistakes:

• Confusing Sentinel with Terraform configuration writing
• Thinking Sentinel deploys resources
• Assuming Sentinel monitors usage

2. Which of the following is the correct way to start a Sentinel policy block?

easy

A. sentinel policy example {

B. policy "example" {

C. policy example {

D. policy "example" = {

Solution

1. Step 1: Recall Sentinel policy syntax

   Sentinel policies start with the keyword 'policy' followed by the policy name in quotes and curly braces.

2. Step 2: Compare options

   policy "example" { matches the correct syntax: policy "example" { ... }

3. Final Answer:

   policy "example" { -> Option B

4. Quick Check:

   Correct Sentinel block start = policy "name" { [OK]

Hint: Policy name must be in quotes after 'policy' keyword [OK]

Common Mistakes:

• Omitting quotes around policy name
• Using '=' instead of '{' to start block
• Adding extra keywords like 'sentinel'

3. Given this Sentinel policy snippet:

policy "check_tags" {
  main = rule {
    all tfplan.resource_changes as _, rc {
      rc.change.after.tags contains "environment"
    }
  }
}

What does this policy check?

medium

A. All resources must have a tag named "environment"

B. At least one resource must have a tag named "environment"

C. No resource should have a tag named "environment"

D. Resources can have any tags without restriction

Solution

1. Step 1: Analyze the 'all' keyword usage

   The policy uses 'all' to check every resource change in the plan.

2. Step 2: Understand the condition

   It requires each resource's tags to contain the key "environment".

3. Final Answer:

   All resources must have a tag named "environment" -> Option A

4. Quick Check:

   all resources have "environment" tag = All resources must have a tag named "environment" [OK]

Hint: 'all' means every resource must meet condition [OK]

Common Mistakes:

• Confusing 'all' with 'any' keyword
• Thinking it checks only one resource
• Ignoring the 'contains' check on tags

4. Identify the error in this Sentinel policy snippet:

policy "check_region" {
  main = rule {
    all tfplan.resource_changes as _, rc {
      rc.change.after.region is "us-east-1"
    }
  }
}

medium

A. The 'main' rule must be a function, not a rule

B. Missing 'all' or 'any' keyword before the loop

C. Policy name must not be in quotes

D. Incorrect use of 'is' instead of '==' for comparison

Solution

1. Step 1: Check comparison operator

   Sentinel uses '==' for equality, not 'is'. 'is' causes syntax error.

2. Step 2: Verify other parts

   The loop uses 'all' correctly. Policy name requires quotes. 'main = rule { }' is standard syntax.

3. Final Answer:

   Incorrect use of 'is' instead of '==' for comparison -> Option D

4. Quick Check:

   Use '==' for equality in Sentinel [OK]

Hint: Use '==' for equality, not 'is' in Sentinel [OK]

Common Mistakes:

• Using 'is' instead of '==' for comparisons
• Thinking policy name cannot be quoted
• Confusing rule and function syntax

5. You want to write a Sentinel policy that blocks any Terraform plan which tries to create an AWS EC2 instance without a tag named "owner". Which approach correctly enforces this?

hard

A. Use 'any' to check if any resource has 'owner' tag and allow plan if true

B. Check only the first resource's tags for 'owner' and ignore others

C. Use 'all' to check every resource of type 'aws_instance' has 'owner' tag in 'after' changes

D. Allow plan if no resources are of type 'aws_instance'

Solution

1. Step 1: Identify the requirement

   Policy must block plans creating EC2 instances missing 'owner' tag.

2. Step 2: Choose correct logic

   'all' ensures every EC2 instance resource has the 'owner' tag in the planned changes.

3. Step 3: Evaluate other options

   'any' would allow plans if just one has the tag, which is unsafe. Checking only first resource misses others. Allowing plans with no EC2 instances is unrelated to the requirement.

4. Final Answer:

   Use 'all' to check every resource of type 'aws_instance' has 'owner' tag in 'after' changes -> Option C

5. Quick Check:

   All EC2 instances must have 'owner' tag = Use 'all' to check every resource of type 'aws_instance' has 'owner' tag in 'after' changes [OK]

Hint: 'all' enforces every EC2 instance has the tag [OK]

Common Mistakes:

• Using 'any' instead of 'all' allowing missing tags
• Checking only one resource instead of all
• Ignoring resource type filtering