Your risk management organization requires that new AWS S3 buckets must be private and encrypted at rest. How can Terraform Cloud automatically and…

Sentinel is Terraform Cloud's embedded policy-as-code framework designed for governance and compliance. It integrates directly into the Terraform run workflow, executing between the plan and apply stages. This allows it to proactively inspect the proposed infrastructure changes in the plan file. A Sentinel policy can be written to check all awss3bucket resources for specific attributes, such as ensuring acl is not public and that serversideencryptionconfiguration is defined. If a configuration violates these rules, Sentinel will fail the run before the apply stage, thereby automatically and proactively enforcing the security control.

A. Auditing with a vulnerability scanner is a reactive process that detects non-compliant resources after they have been created, not a proactive enforcement method.

B. Workspace variables can set defaults but can be overridden within the Terraform code, so they do not enforce compliance if a user provides a different value.

C. Using a module is a best practice for standardization, but it is not an enforcement mechanism; developers can choose not to use the module and create non-compliant resources directly.

1. HashiCorp Terraform Documentation, "Policy Checks": "Policy checks are a feature of Terraform Cloud... They run between the plan and apply stages of a Terraform run. This allows them to check whether the planned changes are acceptable before Terraform makes any changes to infrastructure."

Source: HashiCorp, Terraform Cloud Documentation, Section: "Policy Enforcement", Sub-section: "Policy Checks".

2. HashiCorp Sentinel Documentation, "Policy as Code": "Sentinel enables policy as code, which is the practice of codifying your organization's policies and rules so that you can automatically validate your infrastructure... This proactive approach to policy can prevent policy violations from ever occurring."

Source: HashiCorp, Sentinel Documentation, Section: "Concepts", Sub-section: "Policy as Code".

3. HashiCorp Learn, "Enforce Security Policies with Sentinel" Tutorial: This tutorial demonstrates how to create Sentinel policies to enforce specific rules on resources before they are applied. It states, "Sentinel can enforce policies on resource configuration... This allows you to ensure that all provisioned infrastructure is compliant with your organization's security rules."

Source: HashiCorp Learn, Track: "Get Started with Terraform Cloud", Tutorial: "Enforce Security Policies with Sentinel".