Everyone is shifting policy left. HashiCorp just shipped tfpolicy, a policy-as-code framework in HCL, and it moves the catch earlier than Sentinel ever did. Provider and module rules run pre-plan before a download, resource rules run at plan, and computed values get checked at apply. One language does all of it, so the second one that Sentinel and OPA made you learn is gone.

It still runs at the platform. tfpolicy evaluates inside HCP Terraform, against a plan, with credentials. Its rules are HCL over attrs, a dynamic bag nothing type-checks. attrs.encryption_settings_collection[0].enabled is a string path you either get right or find out about at evaluation time, in the run, not in your editor.

Read the axis by the boundary. tfpolicy reaches earlier than Sentinel and covers more of the run, and every inch of it sits right of the platform line. chant is the only one left of it.

chant policy is typed TypeScript over the resource graph, and it runs in your build, offline, with no HCP and no credentials. A wrong attribute is a red squiggle, and a cross-resource rule reads a typed reference instead of a string filter. The check that gates the apply already passed at your desk.

tfpolicy shifted the catch to pre-plan. chant put it at the keystroke. Go take a closer look.

Read more