Overview
The article discusses how to protect Terraform resources using Sentinel, a policy-as-code framework that helps prevent accidental deletions of critical infrastructure. It outlines the process of implementing Sentinel policies to ensure that certain resources are safeguarded during Terraform operations.
What You'll Learn
1
How to implement Sentinel policies to protect Terraform resources
2
Why automated sanity checks are essential in Terraform workflows
3
When to override Sentinel policies with administrative approval
Prerequisites & Requirements
- Basic understanding of Terraform and its workflow
- Access to Terraform Cloud for using Sentinel
Key Questions Answered
How does Sentinel protect Terraform resources from accidental deletion?
Sentinel allows users to define policies that analyze Terraform plans before they are applied. These policies can prevent the deletion of crucial resources, such as AWS KMS keys, and limit the percentage of resources that can be deleted at one time, ensuring that critical infrastructure remains intact.
What are the key functions used in Sentinel policies?
The main functions in Sentinel policies include 'validate_destroyed_resources' which checks for blacklisted resource types being destroyed, and 'maximum_destroyed_resources' which ensures that no more than a specified percentage of resources are deleted at once. These functions work together to enforce safety during Terraform operations.
What happens if a Sentinel policy fails during a Terraform apply?
If a Sentinel policy fails after a Terraform plan, it blocks the apply step, preventing any changes from being made. An administrator can override this failure, but only after reviewing the situation, which helps avoid accidental deletions or mistakes in resource management.
Key Statistics & Figures
Percentage of resources that can be deleted at one time
10%
Sentinel policies ensure that no more than 10% of all resources are deleted simultaneously, which helps mitigate risks during Terraform operations.
Technologies & Tools
Some links below are affiliate links. We may earn a commission if you make a purchase.
Infrastructure As Code
Terraform
Used to create and manage cloud resources.
Policy As Code
Sentinel
Framework to enforce policies on Terraform plans.
Cloud Provider
AWS
Examples of resources protected include AWS KMS keys and public IPs.
Key Actionable Insights
1Implement Sentinel policies to safeguard critical resources in your Terraform workflows.By using Sentinel, you can prevent accidental deletions of crucial resources, which is especially important in production environments where downtime can be costly.
2Regularly review and update your Sentinel policies to adapt to changing infrastructure needs.As your cloud infrastructure evolves, your policies should reflect new requirements and potential risks to ensure ongoing protection against accidental resource deletions.
Common Pitfalls
1
Failing to implement automated checks can lead to accidental deletions of critical resources.
Without Sentinel, changes to Terraform configurations may go unreviewed, increasing the risk of mistakes that could disrupt services.
Related Concepts
Infrastructure As Code
Policy As Code
Cloud Resource Management