Sentinel policy as code in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a Sentinel policy that checks if the resource type is 'aws_instance'.

Terraform

resource_type = tfplan.resource_changes[0].[1]

Drag options to blanks, or click blank then click option'

Aaddress

Bname

Cmode

Dtype

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'name' instead of 'type' will not give the resource type.

Using 'address' refers to the resource address, not the type.

The 'type' attribute specifies the resource type in the Terraform plan, such as 'aws_instance'.

2fill in blank

medium

Complete the code to check if the resource action includes 'create'.

Terraform

actions = tfplan.resource_changes[0].change.[1]

Drag options to blanks, or click blank then click option'

Aactions

Bbefore

Cafter

Dactions_list

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'before' or 'after' instead of 'actions' will not give the planned actions.

There is no 'actions_list' attribute.

The 'actions' attribute lists the planned actions like 'create', 'update', or 'delete'.

3fill in blank

hard

Fix the error in the policy condition to allow only 't2.micro' instance types.

Terraform

allowed = rule {
  resource_type == "aws_instance" and tfplan.resource_changes[0].change.after.instance_type [1] "t2.micro"
}

Drag options to blanks, or click blank then click option'

A<

B==

C>=

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '!=' will deny the allowed instance type.

Using '>' or '<' is invalid for string comparison here.

The condition must check equality '==' to allow only 't2.micro' instance types.

4fill in blank

hard

Fill both blanks to define a rule that denies any resource with 'delete' action.

Terraform

deny_delete = rule {
  tfplan.resource_changes[0].change.[1] contains [2]
}

Drag options to blanks, or click blank then click option'

Aactions

Bdelete

Cbefore

Dcreate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'before' instead of 'actions' will not work.

Checking for 'create' instead of 'delete' is incorrect.

The 'actions' list contains planned actions. Checking if it contains 'delete' denies deletion.

5fill in blank

hard

Fill all three blanks to create a rule that allows only 'aws_s3_bucket' resources with versioning enabled.

Terraform

allow_s3_versioning = rule {
  resource_type = tfplan.resource_changes[0].[1]
  versioning = tfplan.resource_changes[0].change.after.versioning.[2]
  resource_type == "[3]" and versioning == true
}

Drag options to blanks, or click blank then click option'

Atype

Benabled

Caws_s3_bucket

Dstatus

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'status' instead of 'enabled' will not check versioning correctly.

Using wrong resource type string will fail the rule.

The 'type' attribute identifies the resource type. The 'enabled' attribute inside 'versioning' indicates if versioning is on. The resource type must be 'aws_s3_bucket'.