Saved searches

Use saved searches to filter your results more quickly

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

An example of using Sentinel policies in VCS in Terraform Enterprise

License

Notifications You must be signed in to change notification settings

hashicorp/tfe-policies-example

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Folders and files

Latest commit

History

Repository files navigation

TFE Policies Example

• Some example Sentinel policies that define rules about Terraform runs.
• Sentinel test configurations for those policies.
• A Terraform configuration to sync those policies with Terraform Enterprise, group them into sets, and enforce them on workspaces.

It is intended to be combined with the following:

• A Terraform Enterprise workspace, which runs Terraform to update your Sentinel policies whenever the repo changes.
• A lightweight CI solution (like GitHub Actions), for continuously testing your Sentinel code.

See also: This repo shows an end-to-end workflow with many parts, and uses a small number of Sentinel policies to keep things simple. If you'd rather see a wider range of how to govern specific kinds of infrastructure with Sentinel policies, see the example policies in the hashicorp/terraform-guides repo.

Using with TFE

Fork this repo, then create a Terraform Enterprise workspace linked to your fork. Set values for the following Terraform variables:

• tfe_hostname (optional; defaults to app.terraform.io ) — the hostname of your TFE instance.
• tfe_organization — the name of your TFE organization.
• tfe_token (SENSITIVE) — the organization token or owners team token for your organization.

Add and remove Sentinel policies as desired, and edit main.tf to ensure your policies are enforced on the correct workspaces. Queue an initial run to set up your policies, then continue to iterate on the policy repo and approve Terraform runs as needed.

Testing Sentinel Policies Locally

> sentinel test 

Manually apply a policy using a specific test config:

> sentinel apply -config ./test/aws-restrict-instance-type-prod/dev-not-prod.json aws-restrict-instance-type-prod.sentinel 

(This example results in a policy failure, as intended; see the "test" property of any test config for the expected behavior.)

Testing Sentinel Policies with Github Actions

This repo contains an example of running sentinel test against your sentinel files as PR checks. It uses a third-party action called thrashr888/sentinel-github-actions/test to run the tests. After submitting a PR, you'll see any test errors show up as a comment on the PR.

About

An example of using Sentinel policies in VCS in Terraform Enterprise