Sentinel policy as code in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a Sentinel policy that checks if the resource type is 'aws_instance'.

Terraform

resource_type = tfplan.resource_changes[0].[1]

Drag options to blanks, or click blank then click option'

Aaddress

Bname

Cmode

Dtype

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'name' instead of 'type' will not give the resource type.

Using 'address' refers to the resource address, not the type.

The 'type' attribute specifies the resource type in the Terraform plan, such as 'aws_instance'.

2fill in blank

medium

Complete the code to check if the resource action includes 'create'.

Terraform

actions = tfplan.resource_changes[0].change.[1]

Drag options to blanks, or click blank then click option'

Aactions

Bbefore

Cafter

Dactions_list

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'before' or 'after' instead of 'actions' will not give the planned actions.

There is no 'actions_list' attribute.

The 'actions' attribute lists the planned actions like 'create', 'update', or 'delete'.

3fill in blank

hard

Fix the error in the policy condition to allow only 't2.micro' instance types.

Terraform

allowed = rule {
  resource_type == "aws_instance" and tfplan.resource_changes[0].change.after.instance_type [1] "t2.micro"
}

Drag options to blanks, or click blank then click option'

A<

B==

C>=

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '!=' will deny the allowed instance type.

Using '>' or '<' is invalid for string comparison here.

The condition must check equality '==' to allow only 't2.micro' instance types.

4fill in blank

hard

Fill both blanks to define a rule that denies any resource with 'delete' action.

Terraform

deny_delete = rule {
  tfplan.resource_changes[0].change.[1] contains [2]
}

Drag options to blanks, or click blank then click option'

Aactions

Bdelete

Cbefore

Dcreate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'before' instead of 'actions' will not work.

Checking for 'create' instead of 'delete' is incorrect.

The 'actions' list contains planned actions. Checking if it contains 'delete' denies deletion.

5fill in blank

hard

Fill all three blanks to create a rule that allows only 'aws_s3_bucket' resources with versioning enabled.

Terraform

allow_s3_versioning = rule {
  resource_type = tfplan.resource_changes[0].[1]
  versioning = tfplan.resource_changes[0].change.after.versioning.[2]
  resource_type == "[3]" and versioning == true
}

Drag options to blanks, or click blank then click option'

Atype

Benabled

Caws_s3_bucket

Dstatus

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'status' instead of 'enabled' will not check versioning correctly.

Using wrong resource type string will fail the rule.

The 'type' attribute identifies the resource type. The 'enabled' attribute inside 'versioning' indicates if versioning is on. The resource type must be 'aws_s3_bucket'.

Practice

1. What is the main purpose of a Sentinel policy in Terraform?

easy

A. To enforce rules that control changes to cloud infrastructure

B. To write Terraform configuration files

C. To deploy cloud resources automatically

D. To monitor cloud resource usage

Solution

1. Step 1: Understand Sentinel policy role

   Sentinel policies are designed to enforce rules and guardrails on infrastructure changes.

2. Step 2: Differentiate from other Terraform tasks

   Writing configs and deploying resources are Terraform tasks, not Sentinel's role.

3. Final Answer:

   To enforce rules that control changes to cloud infrastructure -> Option A

4. Quick Check:

   Sentinel policy = enforce rules [OK]

Hint: Sentinel = rules to control changes, not deployment [OK]

Common Mistakes:

• Confusing Sentinel with Terraform configuration writing
• Thinking Sentinel deploys resources
• Assuming Sentinel monitors usage

2. Which of the following is the correct way to start a Sentinel policy block?

easy

A. sentinel policy example {

B. policy "example" {

C. policy example {

D. policy "example" = {

Solution

1. Step 1: Recall Sentinel policy syntax

   Sentinel policies start with the keyword 'policy' followed by the policy name in quotes and curly braces.

2. Step 2: Compare options

   policy "example" { matches the correct syntax: policy "example" { ... }

3. Final Answer:

   policy "example" { -> Option B

4. Quick Check:

   Correct Sentinel block start = policy "name" { [OK]

Hint: Policy name must be in quotes after 'policy' keyword [OK]

Common Mistakes:

• Omitting quotes around policy name
• Using '=' instead of '{' to start block
• Adding extra keywords like 'sentinel'

3. Given this Sentinel policy snippet:

policy "check_tags" {
  main = rule {
    all tfplan.resource_changes as _, rc {
      rc.change.after.tags contains "environment"
    }
  }
}

What does this policy check?

medium

A. All resources must have a tag named "environment"

B. At least one resource must have a tag named "environment"

C. No resource should have a tag named "environment"

D. Resources can have any tags without restriction

Solution

1. Step 1: Analyze the 'all' keyword usage

   The policy uses 'all' to check every resource change in the plan.

2. Step 2: Understand the condition

   It requires each resource's tags to contain the key "environment".

3. Final Answer:

   All resources must have a tag named "environment" -> Option A

4. Quick Check:

   all resources have "environment" tag = All resources must have a tag named "environment" [OK]

Hint: 'all' means every resource must meet condition [OK]

Common Mistakes:

• Confusing 'all' with 'any' keyword
• Thinking it checks only one resource
• Ignoring the 'contains' check on tags

4. Identify the error in this Sentinel policy snippet:

policy "check_region" {
  main = rule {
    all tfplan.resource_changes as _, rc {
      rc.change.after.region is "us-east-1"
    }
  }
}

medium

A. The 'main' rule must be a function, not a rule

B. Missing 'all' or 'any' keyword before the loop

C. Policy name must not be in quotes

D. Incorrect use of 'is' instead of '==' for comparison

Solution

1. Step 1: Check comparison operator

   Sentinel uses '==' for equality, not 'is'. 'is' causes syntax error.

2. Step 2: Verify other parts

   The loop uses 'all' correctly. Policy name requires quotes. 'main = rule { }' is standard syntax.

3. Final Answer:

   Incorrect use of 'is' instead of '==' for comparison -> Option D

4. Quick Check:

   Use '==' for equality in Sentinel [OK]

Hint: Use '==' for equality, not 'is' in Sentinel [OK]

Common Mistakes:

• Using 'is' instead of '==' for comparisons
• Thinking policy name cannot be quoted
• Confusing rule and function syntax

5. You want to write a Sentinel policy that blocks any Terraform plan which tries to create an AWS EC2 instance without a tag named "owner". Which approach correctly enforces this?

hard

A. Use 'any' to check if any resource has 'owner' tag and allow plan if true

B. Check only the first resource's tags for 'owner' and ignore others

C. Use 'all' to check every resource of type 'aws_instance' has 'owner' tag in 'after' changes

D. Allow plan if no resources are of type 'aws_instance'

Solution

1. Step 1: Identify the requirement

   Policy must block plans creating EC2 instances missing 'owner' tag.

2. Step 2: Choose correct logic

   'all' ensures every EC2 instance resource has the 'owner' tag in the planned changes.

3. Step 3: Evaluate other options

   'any' would allow plans if just one has the tag, which is unsafe. Checking only first resource misses others. Allowing plans with no EC2 instances is unrelated to the requirement.

4. Final Answer:

   Use 'all' to check every resource of type 'aws_instance' has 'owner' tag in 'after' changes -> Option C

5. Quick Check:

   All EC2 instances must have 'owner' tag = Use 'all' to check every resource of type 'aws_instance' has 'owner' tag in 'after' changes [OK]

Hint: 'all' enforces every EC2 instance has the tag [OK]

Common Mistakes:

• Using 'any' instead of 'all' allowing missing tags
• Checking only one resource instead of all
• Ignoring resource type filtering