Everyone is shifting policy left. HashiCorp just shipped tfpolicy, a policy-as-code framework in HCL that moves the catch earlier than Sentinel ever did. Provider and module rules run pre-plan before a download. Resource rules run at plan and computed values get checked at apply. One language does all of it so the second one that Sentinel and OPA made you learn is gone.

It still runs at the platform. tfpolicy evaluates inside HCP Terraform, against a plan, with credentials. Its rules are HCL over attrs, a dynamic bag nothing type-checks. attrs.encryption_settings_collection[0].enabled is a string path you either get right or find out about in the run rather than in your editor.

Read the axis by the boundary. tfpolicy reaches earlier than Sentinel and covers more of the run, and every inch of it sits right of the platform line. chant is the only one left of it.

chant policy is typed TypeScript over the resource graph. It runs offline in your build with no HCP and no credentials. A wrong attribute is a red squiggle, and a cross-resource rule reads a typed reference instead of a string filter. The check that gates the apply already passed at your desk.

tfpolicy shifted the catch to pre-plan. chant put it at the keystroke. Go take a closer look.

Read more