Skip to content

Latest commit

 

History

History
27 lines (22 loc) · 2.05 KB

README.md

File metadata and controls

27 lines (22 loc) · 2.05 KB
Raw

Terraform Cloud Sentinel Self-Service Demo

This demo shows how the features of Terraform Cloud can be used to enforce guardrails on a self-service workspace, to mandate use of the Private Module Registry. This is possible without having to know any Sentinel, thanks to the example policies.

Prerequisites

  • A github local fork of hashicorp/terraform-sentinel-policies. The module will create a branch for each workspace, allowing different enforcement levels from the same base policies
  • A github repository containing a module to be published in the PMR
  • A github repository set up as a template, used to create repos for the two VCS-backed workspaces. This should contain root module resources and also call the PMR module.
  • Github token with repo and delete_repo permissions, supplied to the module via the github_token variable.
  • TFC/TFE token, stored in TFE_TOKEN env variable. Tested with User token, but Team token would be better practice

Demo Flow

  • Suggest running from CLI with remote execution in Terraform Cloud
  • terraform apply, which will
    • create the VCS-backed workspaces, trusted and self-service
    • publish a module in the PMR
    • create branches in the policies repo for each workspace
    • create a policy-set for each workspace linked to the policy-repo branches
  • Populate workspace variables for AWS credentials (or whatever is required for your TF code to work)
  • Start a run in the trusted workspace.
  • Follow the self-service policy-set link and edit sentinel.hcl in the self-service branch cloud-agnostic. Set the enforcement level of require-all-resources-from-pmr to hard-mandatory
  • Start a run in the self-service workspace. This will fail due to the PMR policy.
  • Follow the source repo link from the self-service workspace. Edit main.tf to comment out the non-compliant data block and resource block.
  • Watch the resulting run complete now the PMR check passes.
  • Go back to the trusted workspace and show that the run passed first time as the PMR check was still advisory.