Terraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies
summary
Uses Terraform preconditions to block an 8‑core bastion instance (precondition checks AWS instance type cores) and Terraform Cloud Run Tasks + Styra to run OPA/rego policy checks; a Styra public policy stops overly permissive AWS security groups and a custom policy blocks Tuesday deployments until an allowed user in the webhook overrides it. Enforcement modes are advisory vs mandatory (Terraform Cloud) and ignore/monitor/enforce (Styra). Requires Terraform Cloud Team/Governance tier; the demos run and prevent the violating changes.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:17Automated validation benefits
- 2:39Terraform configuration checks
- 4:34Policy as code with OPA
- 7:42Workshop agenda
- 8:49Workshop personas
- 10:21Terraform configuration review
- 12:58Implementing preconditions
- 15:31Terraform Cloud integration
- 19:11Sentinel vs OPA
- 23:09Styra and TFC setup
- 27:28Run task configuration
- 29:28Security policy demo
- 31:55Policy enforcement workflow
- 35:16Custom policy creation
- 38:56Policy override demo
- 41:56Advanced policy use cases
- 44:33Workshop recap
- 48:37Drift detection announcement
related talks
51mTerraform Cloud Learn Lab: Validate Infrastructure, Detect Drift & Enforce OPA Policies
48mValidate infrastructure, detect drift, and enforce policies with HCP Terraform
39mAddressing Cloud Security with OPA
37mPolicy-Aware Infrastructure Generation: Using an MCP Server to Bridge OPA and AI for Terraform
18mImplementing Unit Tests for Terraform with Open Policy Agent
29mTerraform Practices - The Good, the Bad, and the Ugly
45mCatching Commits to Secure Infrastructure as Code
50mFrom Code to Compliance: Enforcing Azure Security with Terraform and...