Your risk management organization requires that new AWS S3 buckets must be private and encrypted at rest. How can Terraform Enterprise automatically and proactively enforce this security control?
Your risk management organization requires that new AWS S3 buckets must be private and encrypted at rest. How can Terraform Enterprise automatically and proactively enforce this security control?
Terraform Enterprise can enforce security controls through the use of Sentinel policies. Sentinel is a policy as code framework that integrates with Terraform Enterprise and checks compliance with predefined rules before each 'apply' operation. By using a Sentinel policy, it ensures that all new S3 buckets are private and encrypted at rest, proactively preventing non-compliant resources from being created or updated.
A. With a Sentinel policy, which runs before every apply. Terraform Enterprise can enforce security controls through the use of Sentinel policies. Sentinel is a policy as code framework that integrates with Terraform Enterprise and can be used to enforce specific security controls. In this case, the Sentinel policy could check that all new S3 buckets are set to be private and encrypted at rest and prevent the Terraform apply from proceeding if the buckets do not meet this requirement. This ensures that the security control is automatically and proactively enforced every time Terraform makes changes to the infrastructure.
A. Reference: https://docs.hashicorp.com/sentinel/intro/what https://medium.com/hashicorp-engineering/enforcing-aws-s3-security-best-practice-using-terraform-sentinel-ddcd181ff4b7
import "tfplan" # Ensure all new S3 buckets are private and encrypted at rest deny[msg] { resources := tfplan.module_paths["aws_s3_bucket"] not all_true([ for r in resources: r.attributes.acl == "private" and r.attributes.server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm == "AES256" ]) msg := "All new S3 buckets must be private and encrypted at rest" }
With a Sentinel policy for sure.
I go with A.
Terraform Enterprise provides the ability to enforce security controls through Sentinel policies, which are a form of policy as code. Sentinel policies allow you to define and enforce organizational or regulatory policies by creating a set of rules that run before each Terraform operation.
Sentinel policy is the best way to manage multiple workspaces
yes A Corrct
yes A Corrct
A is correct
A is correct
AAAAAAAAAAA
As per terraform document
Answer, B only. They want to keep the S3 bucket private. So, it will be a different state file.