What are Terraform Sentinel and Policy as Code?

Question

Accepted Answer

**Sentinel** — HashiCorp policy language for validating Terraform plan.

**Example:**
```python
import "tfplan/v2" as tfplan

allowed_types = ["t3.micro", "t3.small", "t3.medium"]

violations = filter tfplan.resource_changes as _, rc {
  rc.type is "aws_instance" and
  (rc.change.actions contains "create" or rc.change.actions contains "update") and
  not rc.change.after.instance_type in allowed_types
}

main = rule {
  length(violations) is 0
}
```

**Enforcement Levels:**
- **Advisory** — warning.
- **Soft Mandatory** — can be overridden.
- **Hard Mandatory** — blocks.

**Alternatives:** OPA/Conftest, Checkov, tfsec.

DevOps: What are Terraform Sentinel and Policy as Code?