Sentinel in action: Policy as code for secure Terraform workflows in HCP
summary
Demonstrates Sentinel enforcing prewritten AWS policies (aligned with CAS foundation benchmarks) against a Terraform workspace: noncompliant checks flag EBS encryption false, SSH 0.0.0.0/0 and S3 public ACLs and block the run depending on advisory/soft/hard mandatory enforcement. Shows a repo wired into a policy set, plan-time policy evaluation, and remediation cycle. Proves ephemeral resources and write-only arguments keep secrets out of state while tracking version numbers to rotate DB passwords, and ephemeral workspaces auto-destroy on timeout.
AI-written summary · about
chapters (14)
- 0:00Introduction and speaker background
- 0:25Terraform governance and Sentinel overview
- 2:35Sentinel policy enforcement levels
- 4:22AWS compliance policies with Sentinel
- 4:44Demo setup and repository structure
- 6:51Running Terraform with Sentinel policies
- 7:35Analyzing Sentinel policy failures
- 9:00Ephemeral resources in Terraform
- 10:03Ephemeral variables and outputs
- 11:51Write-only arguments for secrets
- 13:16Demo of secret management with write-only
- 16:53Password versioning with write-only
- 17:57Ephemeral workspaces for cleanup
- 18:58Summary and resources
related talks
26mPolicy as Code for Network as Code
27mSentinel policy as code in a highly regulated financial industry
48mValidate infrastructure, detect drift, and enforce policies with HCP Terraform
41mPolicy as Code with Sentinel Language
45mCatching Commits to Secure Infrastructure as Code
52mApisecure, 14 & 15 March 2023 - Mike McCabe, President at Cloud Security Partners.
14mIdentifying Misconfigurations in your Terraform
23mFully SaaS-Based DevOps with Terraform Cloud and GitLab