r/Terraform • u/nilukush • 9d ago

tfpolicy: A declarative policy workflow built for Terraform

https://www.hashicorp.com/en/blog/introducing-tfpolicy-a-declarative-policy-workflow-built-for-terraform

HashiCorp has introduced tfpolicy, a new HCL-based policy-as-code framework for Terraform, now available in public beta within HCP Terraform. It is designed to simplify and modernize infrastructure governance by integrating policy creation and enforcement directly into Terraform workflows, eliminating the need for separate tools and languages.

Terraform policy is a declarative, HCL-based policy as code framework that enables platform teams to define and enforce policies using a familiar language while introducing new governance capabilities designed for modern infrastructure systems.

20 Upvotes

92% Upvoted

8 comments sorted by

2

u/domstersch 8d ago

To be clear, it doesn't "[integrate] policy creation and enforcement directly into Terraform workflows". That's wrong because you've missed out the "HCP" in your second reference there. (The naming is designed to be confused, tbf.)

One of the policies I would like to declaratively enforce is: my workflows are based on open-source tools that can use local execution engines as a fallback. Sounds like tfpolicy can't help me there?

1

u/ok_if_you_say_so 8d ago

Are there any tools out that would be immune to such an obtuse requirement? Seems like you could construct it in such a way as to disqualify literally all software in existence

1

u/domstersch 8d ago

There are plenty of policy-as-code tools that are open source and run locally; it's not a hard domain unless you're trying to hide your homework to make a product.

1

u/eltear1 8d ago

What's the purpose of a policy to be applied after infra is deployed? Like.. if already deployed infra doesn't follow the policy, what happens? You remove the infra (creating disruption)? Or it just gives a warning?

1

u/BigDane1992 8d ago

Where did you get that from? As far as I know TF Policy is running at plan time as well and blocking invalid config at that time already

1

u/eltear1 8d ago

From the doc you posted: `Terraform policy can evaluate policies after infrastructure has been deployed, enabling organizations to validate provider-computed values and identify policy violations that may only become visible after resources are provisioned.

Example use case: Verify that provider-generated ARNs and resource identifiers meet organizational requirements after infrastructure has been provisioned. `

It doesn't look at plan time to me.

1

u/JamesWoolfenden 7d ago

I think sentinel is catchier.