capabilities.work

Onboard a Sentinel or OPA Policy

A 5-step recipe with Terraform. We can help you get access.

Recipe · 5 steps

Onboard a Sentinel or OPA Policy

with Terraform

Idempotently add a policy to an organization at a given enforcement level.

  1. Read the organization to confirm the token can reach it and govern it.
  2. List the organization's policies so a policy that has already been onboarded is not created a second time under the same name.
  3. Create the policy with the supplied engine and enforcement level, since no policy with this name exists in the organization yet.
  4. Read the freshly created policy back to confirm the enforcement level and engine that HCP Terraform actually recorded.
  5. Read the already-present policy instead of creating a duplicate, reporting the enforcement level currently in force so drift from the intended level is visible to the caller.
What you'll need to have ready
  • organizationName: The organization the policy governs.
  • policyName: The policy name (e.g. "require-cost-center-tag").
  • policyDescription: A human readable description of what the policy enforces.
  • policyKind: The policy engine - "sentinel" or "opa".
  • enforcementLevel: One of advisory, soft-mandatory, or hard-mandatory.
For your developer

Arazzo workflow terraform:onboard-policy, 5 operations: GetOrganization → ListPolicies → CreatePolicy → GetPolicy → GetPolicy. Specs on APIs.io.

More recipes with Terraform

Audit a Namespace's Published ModulesAudit an Organization's Full InventoryFind and Cancel a Stuck RunDestroy Infrastructure and Delete the WorkspaceDiscover a Registry Module and Vet ItPush a New State Version Under LockOnboard a Project and Its First WorkspaceOnboard a Team into an OrganizationPin a Module to a Specific Version and Resolve Its SourcePlan a Run and Apply or Discard It