Skip to content

HashiCorp Ecosystem

Sentinel

Sentinel is an embedded policy-as-code framework integrated into the Terraform Platform. Sentinel is a paid feature available in the Terraform Cloud “Teams & Governance” tier.

Key Features:

  • Embedded enforcement – Policies run directly in the Terraform Cloud/Enterprise workflow, actively blocking violations instead of passively detecting them.
  • Fine-grained, conditional policies – Decisions can be made based on resource values, metadata, cost, tags, and more.
  • Multiple enforcement levels – Advisory, Soft Mandatory, and Hard Mandatory levels let policy authors warn, allow overrides, or strictly block changes.
  • External data sources – Policies can query external systems to make broader, context-aware decisions.
  • Multi-cloud compatibility – Ensures regulatory and business compliance across AWS, Azure, GCP, and more.
  • Language – Sentinel uses its own purpose-built policy language (simple, safe, and embedded).
  • Development – A CLI is available for writing, testing, and validating policies.
  • Testing – Built-in test harness supports automated validation.

Benefits of Policy as Code

  • Sandboxing / Guardrails – Prevent dangerous changes and reduce the need for manual reviews.
  • Codification – Policies are clearly documented, version-controlled, and reproducible.
  • Version Control – Changes to policies are tracked the same way as application code.
  • Testing – Sentinel includes a test framework to validate syntax and logic.
  • Automation – Policies integrate into CI/CD pipelines and enable automated remediation and reporting.

Example Sentinel Policies (AWS)

Examples of common Sentinel use cases:

  • Enforce mandatory tags on taggable AWS resources
  • Restrict EC2 instances to specific availability zones
  • Block security groups exposing 0.0.0.0/0 on sensitive ports
  • Restrict allowed EC2 instance types

Example (restrict EC2 AZs):

import "tfplan-functions" as plan
# Allowed EC2 Zones
allowed_zones = [
    "us-east-1a", "us-east-1b"
]
# Get all EC2 instances
allEC2Instances = plan.find_resources("aws_instance")
# Filter to EC2 instances with violations
violatingEC2Instances = plan.filter_attribute_no_in_list(
    allEC2Instances, "availability_zone", allowed_zones, true
)
# Main rule
main = rule {
    length(violatingEC2Instances["messages"]) is 0
}

Terraform with Sentinel

Sentinel integrates into the Terraform Cloud and Enterprise workflow between: Plan → Policy Evaluation → Apply

Within Terraform Cloud, you define Policy Sets and attach them to one or more workspaces.

Packer

Packer is a tool for creating machine images as code.

Key Features:

  • Produces machine images for AWS AMIs, Azure, GCP, Docker, VMware, etc.
  • Uses provisioners (e.g., Ansible, Shell) to configure a temporary VM and bake the configuration into an image.
  • Configuration is written in HCL templates stored in Git.
  • Supports multi-builder builds for generating identical images for multiple platforms in a single run.

Consul

Consul is a service networking platform that provides:

Core Capabilities:

  • Service Discovery – Central registry that enables services to find and connect to each other.
  • Service Mesh – Layer for secure, observable, and resilient service-to-service communication.
  • Configuration Management – Key-value store for application configuration.

Ideal for microservices or large distributed architectures with many independent services.

Terraform with Consul

Consul integrates with Terraform through:

  • Remote Backend – Terraform state can be stored in Consul's key-value store.
  • Consul Provider – Manage Consul resources and configurations using Terraform.

Vault

Vault is a system for securing, storing, and tightly controlling access to secrets.

What Vault Provides:

  • Unified interface for all secrets (AWS IAM keys, Consul KV, GCP tokens, Azure SPs, etc.)
  • Dynamic (short-lived) credentials
  • Fine-grained access control
  • Full audit logging
  • Encryption as a service

Vault abstracts multiple Secrets Engines under a single API.

Terraform with Vault

When Terraform needs credentials (e.g., AWS access keys), Vault can inject short-lived, dynamic secrets instead of long-lived credentials.

Benefits:

  • Secrets exist only for the time of the run.
  • Risk window for credential exposure is minimized.
  • Aligns with zero-trust principles.

Deployment flow example:

  1. Terraform Cloud Run begins.
  2. Terraform requests temporary AWS credentials from Vault.
  3. Terraform applies infrastructure using the temporary credentials.
  4. Credentials automatically expire after a short TTL.