Which Terraform feature allows you to enforce organizational security policies (e.g., "all S3 buckets must have encryption enabled") across all runs automatically?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Sentinel policies in HCP Terraform / Terraform Enterprise

Sentinel is HashiCorp's policy-as-code framework integrated into HCP Terraform and Terraform Enterprise. Policies run after `plan` and before `apply` — they can enforce rules like ...

Real Exam Scenario

Which Terraform feature allows you to enforce organizational security policies (e.g., "all S3 buckets must have encryption enabled") across all runs automatically?

✓ Correct Answer & Explanation

Correct Answer

Sentinel policies in HCP Terraform / Terraform Enterprise

Why This Answer Is Correct

Sentinel is HashiCorp's policy-as-code framework integrated into HCP Terraform and Terraform Enterprise. Policies run after `plan` and before `apply` — they can enforce rules like "all S3 buckets must have server-side encryption", "resources must have required tags", or "instance types must be in an approved list". Violations block the apply. `terraform validate` only checks syntax and schema, not policy constraints.