Which of these are benefits of using Sentinel with HCP Terraform/Terraform Cloud? (Pick the 3 correct responses)

(A) and (D) represent core functionalities and benefits of Sentinel. Sentinel is a policy-as-code framework that integrates with HCP Terraform to enforce policies on Terraform runs. A common use case (A) is to restrict infrastructure resources, like AWS instances, to a list of approved AMIs by inspecting the Terraform plan. More broadly, this capability allows organizations to enforce security, compliance, and operational best practices as code (D), such as preventing the creation of overly permissive firewall rules or ensuring all storage buckets have encryption enabled.

B. Sentinel Policies can be written in HashiCorp Configuration Language (HCL).

Sentinel uses its own purpose-built policy language. While it shares some aesthetic similarities with HCL, it is a distinct language with different syntax, data types, and functions.

C. You can check out and check in cloud access keys.

This describes the function of a secrets management tool, specifically the dynamic secrets feature of HashiCorp Vault. Sentinel enforces policy; it does not manage the lifecycle of secrets.

1. HashiCorp Documentation, "Sentinel Language - Introduction": "The Sentinel language was built to be a simple, easy-to-learn language for policy... While it has some similarities to other languages, it is a unique language." This reference directly refutes option (B).

2. HashiCorp Learn, "Enforce Policy with Sentinel": This tutorial provides a clear overview of Sentinel's purpose: "Sentinel is a policy as code framework that lets you enforce rules on your infrastructure." It includes examples like restricting AWS instance types, which is analogous to restricting AMIs, supporting option (A) and the general principle of option (D).

3. HashiCorp Documentation, "The tfrun Import": This document details how Sentinel policies can access data from a Terraform run. It shows policies inspecting planned values (e.g., resource.config.ami), which is the mechanism for enforcing rules like the one described in option (A).

4. HashiCorp Vault Documentation, "AWS - Secrets Engine": "The AWS secrets engine generates AWS access credentials dynamically based on IAM policies." This documentation confirms that generating (checking out) dynamic credentials is a function of Vault, not Sentinel, refuting option (C).