Validate infrastructure, detect drift, and enforce policies with HCP Terraform
summary
Uses HCP Terraform to run plan-time checks, enforce preconditions in a module (data source reads the AWS instance type and a lifecycle precondition requires <= 2 cores, blocking a 2xlarge with ~8 cores), and apply Sentinel policies from a VCS-backed policy set (advisory day-of-week rule set to Wednesday plus a soft-mandatory block for 0.0.0.0/0 Ingress). Health assessments run daily (or manually), detect drift when a security group is edited, show a plan-like delta, and can trigger an on-platform apply to remediate.
AI-written summary · about
chapters (9)
- 0:00Introduction to validation
- 7:09Setting up the lab
- 11:42Preconditions for modules
- 18:11Policy as code with Sentinel
- 23:16Configuring policy sets
- 32:23Policy enforcement demo
- 33:27Detecting infrastructure drift
- 38:07Manual changes and drift
- 41:24Summary and Q&A
related talks
20mSentinel in action: Policy as code for secure Terraform workflows in HCP
51mTerraform Cloud Learn Lab: Validate Infrastructure, Detect Drift & Enforce OPA Policies
52mTerraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies
39mAutomating Immutable Infrastructure With Packer & Terraform
14mIdentifying Misconfigurations in your Terraform
45mCatching Commits to Secure Infrastructure as Code
30mWhy you should take care of infrastructure drift
42mHCP Vault Learn Lab: Operations with Terraform