Sentinel policy as code in a highly regulated financial industry
summary
Fannie Mae enforces over 400 preventative security, architecture, and finops guardrails using Terraform Enterprise + Sentinel tied to a VCS policy set that auto-updates on merge. Policies live in Git, use shared functions, are tested with Sentinel mocks and CLI per-case, and gate applies (noncompliant runs hard-fail). Development includes feature branches, peer and InfoSec review, full repo test runs, and metrics — a policy change once ballooned evaluation time to ~10 minutes.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:03Terraform Enterprise at Fannie Mae
- 2:45Sentinel policy as code
- 5:55Policy development lifecycle
- 8:20Developing a DynamoDB policy
- 13:17Testing policies with mocks
- 18:52Review and approval process
- 21:22Deploying policies in Terraform Enterprise
- 22:43Developer experience with guardrails
- 24:31Lessons learned and best practices
- 26:36Additional resources and conclusion
related talks
20mSentinel in action: Policy as code for secure Terraform workflows in HCP
26mPolicy as Code for Network as Code
41mPolicy as Code with Sentinel Language
43mSentinel: A Platform for Fine-grained Application Security
29mCompliance At Scale: Hardened Terraform Modules at Morgan Stanley
45mCatching Commits to Secure Infrastructure as Code
25mPolicy as [versioned] Code
22mPolicy as [versioned] Code - How to do it Right