Policy as Code

Chapter 12. PaC and Terraform IaC

In Chapter 11, I introduced PaC with IaC. In that chapter, I primarily focused on AWS with AWS CloudFormation and Terraform. Terraform is used beyond AWS, though, and there are other PaC tools that satisfy the requirements for well-managed and secure IaC implementations.

In this chapter, we’ll continue looking at how to use Terraform for IaC while expanding PaC options. For initial continuity with Chapter 11, I will start this chapter with another AWS example. Then, I will move to a GCP example with PaC solutions.

Let’s start by exploring HashiCorp Sentinel.

HashiCorp Sentinel

You learned in Chapter 11 that OPA is very effective for evaluating the JSON output of a Terraform plan. As you will see later in this chapter, several IaC tools support OPA. However, HashiCorp developed their own PaC language to validate Terraform artifacts.

According to the documentation, HashiCorp Sentinel was designed to be easy to use for programmers and nonprogrammers alike. I have been writing code for almost 30 years, and I find the Sentinel syntax easy to understand. With some exceptions, most languages have simple syntaxes, though; it’s the lexicon and libraries that usually prove more challenging. For example, let’s look at my simple Hello World example:

# sentinel hello world
h = "Hello"
s = " "
w = "World"

func msg(m) {
  return m + w
}

main = rule {
  print(msg(h + s)) 
}

To understand how this policy evaluates, we must first consider some Sentinel ground rules: ...