Policy as Code with Sentinel Language

on YouTube ↗41m

" summary

HashiCorp ships a new Sentinel language that codifies compliance rules, a Go-friendly runtime that embeds in tools, a simulator for local testing, and an import SDK for querying external systems. Policies are lazy and cached with rule memoization, run in a sandboxed evaluator, and support advisory/soft/hard enforcement levels so checks can warn, allow overrides, or block actions. Examples include preventing a fat‑finger 5,000‑VM request and gating AMI/container whitelists.

AI-written summary · about

" chapters (44)

1. 0:00Introduction
2. 0:55Infrastructure as Code
3. 1:10Before Infrastructure as Code
4. 2:09What is Infrastructure as Code
5. 3:36Benefits of Infrastructure as Code
6. 4:55Prerequisites
7. 5:56API Contracts
8. 6:44The Paradox of Automation
9. 7:49Accidental Error
10. 8:41Malicious Intent
11. 9:25Separation of Responsibility
12. 12:09Organizational Challenges
13. 12:51Sentinel
14. 13:45Goals
15. 14:58Embedding
16. 15:48Simplicity
17. 16:53Debugging
18. 17:23NGOfriendliness
19. 18:05Challenges
20. 19:09Design Decisions
21. 19:20Dynamic Typing
22. 20:31FirstClass Rules
23. 20:52Rules as Functions
24. 23:20Dedicated Existential Operators
25. 24:09Plain English Operators
26. 24:43Handling Errors
27. 27:21Syntax
28. 29:51Lexer parser
29. 30:41Syntax semantics checking
30. 31:12The evaluator
31. 32:14Avoiding user functions
32. 32:48Enforcement levels
33. 33:52Things you cannot override
34. 34:05Shortcircuiting
35. 34:35Embedded runtime
36. 34:56Simulator
37. 35:21Application
38. 36:42Import SDK
39. 37:30Plugin Ecosystem
40. 37:50Config Protection
41. 38:20Use Cases
42. 39:04Compliance
43. 39:29Policies will never be exhaustive
44. 40:13Conclusion

" related talks

• 26mPolicy as Code for Network as CodeNico Vibert · HashiTalks 2022
• 27mSentinel policy as code in a highly regulated financial industryMaksim Frenkel · HashiConf 2024
• 20mSentinel in action: Policy as code for secure Terraform workflows in HCPMahendran Selvakumar · HashiConf 2025
• 43mSentinel: A Platform for Fine-grained Application SecuritySudheendra Murthy · KubeCon + CloudNativeCon North America 2016
• 23mSecure Your Systems the Better Way Using Policy-as-CodeMarino Wijay, Adriana Villela · Platform Engineering Day NA 2024
• 22mPolicy as [versioned] Code - How to do it RightChris Nesbitt-Smith · Spinnaker Summit 2022
• 25mPolicy as [versioned] CodeChris Nesbitt-Smith · Open Source Summit Latin America 2022
• 34mPolicy As [Versioned] CodeChris Nesbitt-Smith · Critical Software Summit @ Open Source Summit Europe 2022