Policy as Code for Network as Code
summary
Demonstration uses Terraform Cloud + GitHub with three Sentinel policies attached to a workspace; Terraform plan shows six resources and Sentinel policies run at plan time to check tags, VPN ciphers and security-group CIDRs. A five‑to‑six‑line Sentinel rule detects DH group 2 and flags it; enforcement levels are advisory (missing tags), soft‑mandatory (can be overridden for legacy VPNs), and hard-mandatory blocks apply (0.0.0.0/0 ingress stops apply), so policy prevents risky network changes before they reach devices.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 1:53Network automation evolution
- 4:46Infrastructure as Code benefits
- 7:16Policy as Code for guardrails
- 12:45Demo setup and workspace creation
- 15:21Policy checks during Terraform plan
- 17:58Terraform apply and policy enforcement
- 18:42Modifying configuration and policy failure
- 21:50Overriding soft mandatory policies
- 22:10Hard mandatory policy enforcement
- 24:20Key takeaways and conclusion
related talks
20mSentinel in action: Policy as code for secure Terraform workflows in HCP
27mSentinel policy as code in a highly regulated financial industry
41mPolicy as Code with Sentinel Language
45mCatching Commits to Secure Infrastructure as Code
48mValidate infrastructure, detect drift, and enforce policies with HCP Terraform
52mTerraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies
43mSentinel: A Platform for Fine-grained Application Security
51mTerraform Cloud Learn Lab: Validate Infrastructure, Detect Drift & Enforce OPA Policies