terraform Policies and policy sets Add policies to HCP Terraform group policies into policy sets and apply policy sets to workspaces HCP Terraform checks the Terraform plan against the policy set for each run Policies are rules that HCP Terraform enforces on Terraform runs You can define policies using either the Sentinel terraform cloud docs policy enforcement sentinel or Open Policy Agent OPA terraform cloud docs policy enforcement opa policy as code frameworks page title Manage Policies and Policy Sets HCP Terraform

Answer:
---
page_title: Manage Policies and Policy Sets - HCP Terraform
description: >-
 Add policies to HCP Terraform, group policies into policy sets, and apply policy sets to workspaces. HCP Terraform checks the Terraform plan against the policy set for each run.
---

# Policies and policy sets

Policies are rules that HCP Terraform enforces on Terraform runs. You can define policies using either the [Sentinel](/terraform/cloud-docs/policy-enforcement/sentinel) or [Open Policy Agent (OPA)](/terraform/cloud-docs/policy-enforcement/opa) policy-as-code frameworks.

<!-- BEGIN: TFC:only name:pnp-callout -->

@include 'tfc-package-callouts/policies.mdx'

<!-- END: TFC:only name:pnp-callout -->

Policy sets are collections of policies you can apply globally or to specific [projects](/terraform/cloud-docs/projects/manage) and workspaces in your organization. For each run in the applicable workspaces, HCP Terraform checks the Terraform plan against the policy set. Depending on the [enforcement level](#policy-enforcement-levels), failed policies can stop a run in a workspace. If you do not want to enforce a policy set on a specific workspace, you can exclude the workspace from that set.

## Permissions

To view and manage policies and policy sets, you must have [manage policy permissions](/terraform/cloud-docs/users-teams-organizations/permissions#manage-policies) for your organization.

## Policy checks versus policy evaluations

Policy checks and evaluations can access different types of data and enable slightly different workflows.

### Policy checks

Only Sentinel policies can run as policy checks. Checks can access cost estimation data but can only use the latest version of Sentinel.

~> **Warning:** Policy checks are deprecated and will be permanently removed in August 2025. We recommend that you start using policy evaluations to avoid disruptions.

### Policy evaluations

OPA policy sets can only run as policy evaluations, and you can enable policy evaluations for Sentinel policy sets by selecting the `Enhanced` policy set type. Policy evaluations run within the [HCP Terraform agent](/terraform/cloud-docs/agents) in HCP Terraform's infrastructure.

For Sentinel policy sets, using policy evaluations lets you:
- Enable overrides for soft-mandatory and hard-mandatory policies, letting any user with [Manage Policy Overrides permission](/terraform/cloud-docs/users-teams-organizations/permissions#manage-policy-overrides) proceed with a run in the event of policy failure.
- Select a specific Sentinel runtime version for the policy set.

Policy evaluations **cannot** access cost estimation data, so use policy checks if your policies rely on cost estimates.

~> **Tip:** Sentinel runtime version pinning is supported only for Sentinel 0.23.1 and above, as well as HCP Terraform agent versions 1.13.1 and above

## Policy enforcement levels

You can set an enforcement level for each policy that determines what happens when a Terraform plan does not pass the policy rule. Sentinel and OPA policies have different enforcement levels available.

### Sentinel

Sentinel provides three policy enforcement levels:

- **advisory:** Failed policies never interrupt the run. They provide information about policy check failures in the UI.
- **soft mandatory:** Failed policies stop the run, but any user with [Manage Policy Overrides permission](/terraform/cloud-docs/users-teams-organizations/permissions#manage-policy-overrides) can override these failures and allow the run to complete.
- **hard mandatory:** Failed policies stop the run. Terraform does not apply runs with failed **hard mandatory** policies until a user fixes the issue that caused the failure.

### OPA

OPA provides two policy enforcement levels:

- **advisory** Failed policies never interrupt the run. They provide information about policy failures in the UI.
- **mandatory:** Failed policies stop the run, but any user with [Manage Policy Overrides permission](/terraform/cloud-docs/users-teams-organizations/permissions#manage-policy-overrides) can override these failures and allow the run to complete.

## Policy publishing workflows

You can create policies and policy sets for your HCP Terraform organization in one of three ways:
- **HCP Terraform web UI:** Add individually-managed policies manually in the HCP Terraform UI, and store your policy code in HCP Terraform. This workflow is ideal for initial experimentation with policy enforcement, but we do not recommend it for organizations with large numbers of policies.
- **Version control:**  Connect HCP Terraform to a version control repository containing a policy set. When you push changes to the repository, HCP Terraform automatically uses the updated policy set.
- **Automated:** Push versions of policy sets to HCP Terraform with the [HCP Terraform Policy Sets API](/terraform/cloud-docs/api-docs/policy-sets#create-a-policy-set-version) or the  `tfe` provider [`tfe_policy_set`](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/policy_set) resource. This workflow is ideal for automated Continuous Integration and Deployment (CI/CD) pipelines.

### Manage individual policies in the web UI

You can add policies directly to HCP Terraform using the web UI. This process requires you to paste completed, valid Sentinel or Rego code into the UI. We recommend validating your policy code before adding it to HCP Terraform.

#### Add managed policies

To add an individually managed policy:

1. Go to **Policies** in your organization’s settings. A list of managed policies in HCP Terraform appears. Each policy designates its policy framework (Sentinel or OPA) and associated policy sets.
1. Click **Create a new policy**.
1. Choose the **Policy framework** you want to use. You can only create a policy set from policies written using the same framework. You cannot change the framework type after you create the policy.
1. Complete the following fields to define the policy:
   - **Policy Name:** Add a name containing letters, numbers, `-`, and `_`. HCP Terraform displays this name in the UI. The name must be unique within your organization.
   - **Description:** Describe the policy’s purpose. The description supports Markdown rendering, and HCP Terraform displays this text in the UI.
   - **Enforcement mode:** Choose whether this policy can stop Terraform runs and whether users can override it. Refer to [policy enforcement levels](#policy-enforcement-levels) for more details.
   - **(OPA Only) Query:** Write a query to identify a specific policy rule within your rego code. HCP Terraform uses this query to determine the result of the policy. The query is typically a combination of the policy package name and rule name, such as `terraform.deny`. The result of this query must be an array. The policy passes when the array is empty.
   - **Policy code**: Paste the code for the policy: either Sentinel code or Rego code for OPA policies. The UI provides syntax highlighting for the policy language.
   - **(Optional) Policy sets:** Select one or more existing managed policy sets where you want to add the new policy. You can only select policy sets compatible with the chosen policy set framework. If there are no policy sets available, you can [create a new one](#create-policy-sets).

The policy is now available in the HCP Terraform UI for you to edit and add to one or more policy sets.

#### Edit managed policies

To edit a managed policy:

- Go to **Policies** in your organization’s settings.
- Click the policy you want to edit to go to its details page.
- Edit the policy's fields and then click **Update policy**.

#### Delete managed policies

~> **Warning:** Deleting a policy that applies to an active run causes that run’s policy evaluation stage to error. We recommend warning other members of your organization before you delete widely used policies.

You can not restore policies after deletion. You must manually re-add them to HCP Terraform. You may want to save the policy code in a separate location before you delete the policy.

To delete a managed policy:

- Go to **Policies** in your organization’s settings.
- Click the policy you want to delete to go to its details page.
- Click **Delete policy** and then click **Yes, delete policy** to confirm.

The policy no longer appears in HCP Terraform and in any associated policy sets.

## Manage policy sets

Policy sets are collections of policies that you can apply globally or to specific [projects](/terraform/cloud-docs/projects/manage) and workspaces.

To view and manage policy sets, go to the **Policy Sets** section of your organization’s settings. This page contains all of the policy sets available in the organization, including those added through the API.

The way you set up and configure a new policy set depends on your workflow and where you store policies.

- For [managed policies](#managed-policies), you use the UI to create a policy set and add managed policies.
- For policy sets in a version control system, you use the UI to create a policy set connected to that repository. HCP Terraform automatically refreshes the policy set when you change relevant files in that repository. Version control policy sets have specific organization and formatting requirements. Refer to [Sentinel VCS Repositories](/terraform/cloud-docs/policy-enforcement/sentinel/vcs) and [OPA VCS Repositories](/terraform/cloud-docs/policy-enforcement/opa/vcs) for details.
- For automated workflows like continuous deployment, you can use the UI to create an empty policy set and then use the [Policy Sets API](/terraform/cloud-docs/api-docs/policy-sets) to add policies. You can also use the API or the [`tfe` provider (Sentinel Only)](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/policy_set) to add an entire, packaged policy set.

### Create policy sets

To create a policy set:
1. Go to **Policy Sets** in your organization’s settings.
1. Click **Connect a new policy set**.
1. Choose your workflow.
   - For managed policies, click **create a policy set with individually managed policies**. HCP Terraform shows a form to create a policy set and add individually managed policies.
   - For version control policies, choose a version control provider and then select the repository with your policy set. HCP Terraform shows a form to create a policy set connected to that repository.
   - For automated workflows, click **No VCS Connection**. HCP Terraform shows a form to create an empty policy set. You can use the API to add policies to this empty policy set later.
1. Choose a **Policy framework** for the policies you want to add. A policy set can only contain policies that use the same framework (OPA or Sentinel). You cannot change a policy set's framework type after creation.
1. Choose a policy set scope:
   - **Policies enforced globally:** HCP Terraform automatically enforces this global policy set on all of an organization's existing and future workspaces.
   - **Policies enforced on selected projects and workspaces:** Use the text fields to find and select the workspaces and projects to enforce this policy set on. This affects all current and future workspaces for any chosen projects.
1. **(Optional)** Add **Policy exclusions** for this policy set. Specify any workspaces in the policy set's scope that HCP Terraform will not enforce this policy set on.
1. **(Sentinel Only)** Choose a policy set type:
   - **Standard:** This is the default workflow. A Sentinel policy set uses a [policy check](#policy-checks) in HCP Terraform and lets you access cost estimation data.
   - **Enhanced:** A Sentinel policy set uses a [policy evaluation](#policy-evaluations) in HCP Terraform. This lets you enable policy overrides and enforce a Sentinel runtime version
1. **(OPA Only)** Select a **Runtime version** for this policy set.

1. **(OPA Only)** Allow **Overrides**, which enables users with override policy permissions to apply plans that have [mandatory policy](#policy-enforcement-levels) failures.
1. **(VCS Only)** Optionally specify the **VCS branch** within your VCS repository where HCP Terraform should import new versions of policies. If you do not set this field, HCP Terraform uses your selected VCS repository's default branch.
1. **(VCS Only)** Specify where your policy set files live using the **Policies path**. This lets you maintain multiple policy sets within a single repository. Use a relative path from your root directory to the directory that contains either the `sentinel.hcl` (Sentinel) or `policies.hcl` (OPA) configuration files. If you do not set this field, HCP Terraform uses the repository's root directory.
1. **(Managed Policies Only)** Select managed **Policies** to add to the policy set. You can only add policies written with the same policy framework you selected for this set.
1. Choose a descriptive and unique **Name** for the policy set. You can use any combination of letters, numbers, `-`, and `_`.
1. Write an optional **Description** that tells other users about the purpose of the policy set and what it contains.

### Edit policy sets

To edit a policy set:

1. Go to the **Policy Sets** section of your organization’s settings.
1. Click the policy set you want to edit to go to its settings page.
1. Adjust the settings and click **Update policy set**.

### Evaluate a policy runtime upgrade

You can validate that changing a policy runtime version does not introduce any breaking changes.

To perform a policy evaluation:

1. Go to the **Policy Sets** section of your organization’s settings.
1. Click the policy set you want to upgrade.
1. Click the **Evaluate** tab.
1. Select the **Runtime version** you wish to upgrade to.
1. Select a **Workspace** to test the policy and upgraded version against.
1. Click **Evaluate**.

HCP Terraform will execute the policy set using the specified version and the latest plan data for the selected workspace. It will display the evaluation results. If the evaluation returns a `Failed` status, inspect the JSON output to determine whether the issue is related to a non-compliant resource or is due to a syntax issue.
If the evaluation results in an error, check that the policy configuration is valid.

### Delete policy sets

~> **Warning:** Deleting a policy set that applies to an active run causes that run’s policy evaluation stage to error. We recommend warning other members of your organization before you delete widely used policy sets.

You can not restore policy sets after deletion. You must manually re-add them to HCP Terraform.

To delete a policy set:

1. Go to **Policy Sets** in your organization’s settings.
2. Click the policy set you want to delete to go to its details page.
3. Click **Delete policy** and then click **Yes, delete policy set** to confirm.

The policy set no longer appears on the UI and HCP Terraform no longer applies it to any workspaces. For managed policy sets, all of the individual policies are still available in HCP Terraform. You must delete each policy individually to remove it from your organization.

### (Sentinel only) Sentinel parameters

[Sentinel parameters](https://docs.hashicorp.com/sentinel/language/parameters) are a list of key/value pairs that HCP Terraform sends to the Sentinel runtime when performing policy checks on workspaces. If the value parses as JSON, HCP Terraform sends it to Sentinel as the corresponding type (string, boolean, integer, map, or list). If the value fails JSON validation, HCP Terraform sends it as a string.

You can set Sentinel parameters when you [edit a policy set](#edit-policy-sets).

page title  Manage Policies and Policy Sets   HCP Terraform description      Add policies to HCP Terraform  group policies into policy sets  and apply policy sets to workspaces  HCP Terraform checks the Terraform plan against the policy set for each run         Policies and policy sets  Policies are rules that HCP Terraform enforces on Terraform runs  You can define policies using either the  Sentinel   terraform cloud docs policy enforcement sentinel  or  Open Policy Agent  OPA    terraform cloud docs policy enforcement opa  policy as code frameworks        BEGIN  TFC only name pnp callout       include  tfc package callouts policies mdx        END  TFC only name pnp callout      Policy sets are collections of policies you can apply globally or to specific  projects   terraform cloud docs projects manage  and workspaces in your organization  For each run in the applicable workspaces  HCP Terraform checks the Terraform plan against the policy set  Depending on the  enforcement level   policy enforcement levels   failed policies can stop a run in a workspace  If you do not want to enforce a policy set on a specific workspace  you can exclude the workspace from that set      Permissions  To view and manage policies and policy sets  you must have  manage policy permissions   terraform cloud docs users teams organizations permissions manage policies  for your organization      Policy checks versus policy evaluations  Policy checks and evaluations can access different types of data and enable slightly different workflows       Policy checks  Only Sentinel policies can run as policy checks  Checks can access cost estimation data but can only use the latest version of Sentinel        Warning    Policy checks are deprecated and will be permanently removed in August 2025  We recommend that you start using policy evaluations to avoid disruptions       Policy evaluations  OPA policy sets can only run as policy evaluations  and you can enable policy evaluations for Sentinel policy sets by selecting the  Enhanced  policy set type  Policy evaluations run within the  HCP Terraform agent   terraform cloud docs agents  in HCP Terraform s infrastructure   For Sentinel policy sets  using policy evaluations lets you    Enable overrides for soft mandatory and hard mandatory policies  letting any user with  Manage Policy Overrides permission   terraform cloud docs users teams organizations permissions manage policy overrides  proceed with a run in the event of policy failure    Select a specific Sentinel runtime version for the policy set   Policy evaluations   cannot   access cost estimation data  so use policy checks if your policies rely on cost estimates        Tip    Sentinel runtime version pinning is supported only for Sentinel 0 23 1 and above  as well as HCP Terraform agent versions 1 13 1 and above     Policy enforcement levels  You can set an enforcement level for each policy that determines what happens when a Terraform plan does not pass the policy rule  Sentinel and OPA policies have different enforcement levels available       Sentinel  Sentinel provides three policy enforcement levels       advisory    Failed policies never interrupt the run  They provide information about policy check failures in the UI      soft mandatory    Failed policies stop the run  but any user with  Manage Policy Overrides permission   terraform cloud docs users teams organizations permissions manage policy overrides  can override these failures and allow the run to complete      hard mandatory    Failed policies stop the run  Terraform does not apply runs with failed   hard mandatory   policies until a user fixes the issue that caused the failure       OPA  OPA provides two policy enforcement levels       advisory   Failed policies never interrupt the run  They provide information about policy failures in the UI      mandatory    Failed policies stop the run  but any user with  Manage Policy Overrides permission   terraform cloud docs users teams organizations permissions manage policy overrides  can override these failures and allow the run to complete      Policy publishing workflows  You can create policies and policy sets for your HCP Terraform organization in one of three ways      HCP Terraform web UI    Add individually managed policies manually in the HCP Terraform UI  and store your policy code in HCP Terraform  This workflow is ideal for initial experimentation with policy enforcement  but we do not recommend it for organizations with large numbers of policies      Version control     Connect HCP Terraform to a version control repository containing a policy set  When you push changes to the repository  HCP Terraform automatically uses the updated policy set      Automated    Push versions of policy sets to HCP Terraform with the  HCP Terraform Policy Sets API   terraform cloud docs api docs policy sets create a policy set version  or the   tfe  provider   tfe policy set   https   registry terraform io providers hashicorp tfe latest docs resources policy set  resource  This workflow is ideal for automated Continuous Integration and Deployment  CI CD  pipelines       Manage individual policies in the web UI  You can add policies directly to HCP Terraform using the web UI  This process requires you to paste completed  valid Sentinel or Rego code into the UI  We recommend validating your policy code before adding it to HCP Terraform        Add managed policies  To add an individually managed policy   1  Go to   Policies   in your organization s settings  A list of managed policies in HCP Terraform appears  Each policy designates its policy framework  Sentinel or OPA  and associated policy sets  1  Click   Create a new policy    1  Choose the   Policy framework   you want to use  You can only create a policy set from policies written using the same framework  You cannot change the framework type after you create the policy  1  Complete the following fields to define the policy         Policy Name    Add a name containing letters  numbers       and      HCP Terraform displays this name in the UI  The name must be unique within your organization         Description    Describe the policy s purpose  The description supports Markdown rendering  and HCP Terraform displays this text in the UI         Enforcement mode    Choose whether this policy can stop Terraform runs and whether users can override it  Refer to  policy enforcement levels   policy enforcement levels  for more details          OPA Only  Query    Write a query to identify a specific policy rule within your rego code  HCP Terraform uses this query to determine the result of the policy  The query is typically a combination of the policy package name and rule name  such as  terraform deny   The result of this query must be an array  The policy passes when the array is empty         Policy code    Paste the code for the policy  either Sentinel code or Rego code for OPA policies  The UI provides syntax highlighting for the policy language          Optional  Policy sets    Select one or more existing managed policy sets where you want to add the new policy  You can only select policy sets compatible with the chosen policy set framework  If there are no policy sets available  you can  create a new one   create policy sets    The policy is now available in the HCP Terraform UI for you to edit and add to one or more policy sets        Edit managed policies  To edit a managed policy     Go to   Policies   in your organization s settings    Click the policy you want to edit to go to its details page    Edit the policy s fields and then click   Update policy          Delete managed policies       Warning    Deleting a policy that applies to an active run causes that run s policy evaluation stage to error  We recommend warning other members of your organization before you delete widely used policies   You can not restore policies after deletion  You must manually re add them to HCP Terraform  You may want to save the policy code in a separate location before you delete the policy   To delete a managed policy     Go to   Policies   in your organization s settings    Click the policy you want to delete to go to its details page    Click   Delete policy   and then click   Yes  delete policy   to confirm   The policy no longer appears in HCP Terraform and in any associated policy sets      Manage policy sets  Policy sets are collections of policies that you can apply globally or to specific  projects   terraform cloud docs projects manage  and workspaces   To view and manage policy sets  go to the   Policy Sets   section of your organization s settings  This page contains all of the policy sets available in the organization  including those added through the API   The way you set up and configure a new policy set depends on your workflow and where you store policies     For  managed policies   managed policies   you use the UI to create a policy set and add managed policies    For policy sets in a version control system  you use the UI to create a policy set connected to that repository  HCP Terraform automatically refreshes the policy set when you change relevant files in that repository  Version control policy sets have specific organization and formatting requirements  Refer to  Sentinel VCS Repositories   terraform cloud docs policy enforcement sentinel vcs  and  OPA VCS Repositories   terraform cloud docs policy enforcement opa vcs  for details    For automated workflows like continuous deployment  you can use the UI to create an empty policy set and then use the  Policy Sets API   terraform cloud docs api docs policy sets  to add policies  You can also use the API or the   tfe  provider  Sentinel Only   https   registry terraform io providers hashicorp tfe latest docs resources policy set  to add an entire  packaged policy set       Create policy sets  To create a policy set  1  Go to   Policy Sets   in your organization s settings  1  Click   Connect a new policy set    1  Choose your workflow       For managed policies  click   create a policy set with individually managed policies    HCP Terraform shows a form to create a policy set and add individually managed policies       For version control policies  choose a version control provider and then select the repository with your policy set  HCP Terraform shows a form to create a policy set connected to that repository       For automated workflows  click   No VCS Connection    HCP Terraform shows a form to create an empty policy set  You can use the API to add policies to this empty policy set later  1  Choose a   Policy framework   for the policies you want to add  A policy set can only contain policies that use the same framework  OPA or Sentinel   You cannot change a policy set s framework type after creation  1  Choose a policy set scope         Policies enforced globally    HCP Terraform automatically enforces this global policy set on all of an organization s existing and future workspaces         Policies enforced on selected projects and workspaces    Use the text fields to find and select the workspaces and projects to enforce this policy set on  This affects all current and future workspaces for any chosen projects  1     Optional    Add   Policy exclusions   for this policy set  Specify any workspaces in the policy set s scope that HCP Terraform will not enforce this policy set on  1     Sentinel Only    Choose a policy set type         Standard    This is the default workflow  A Sentinel policy set uses a  policy check   policy checks  in HCP Terraform and lets you access cost estimation data         Enhanced    A Sentinel policy set uses a  policy evaluation   policy evaluations  in HCP Terraform  This lets you enable policy overrides and enforce a Sentinel runtime version 1     OPA Only    Select a   Runtime version   for this policy set   1     OPA Only    Allow   Overrides    which enables users with override policy permissions to apply plans that have  mandatory policy   policy enforcement levels  failures  1     VCS Only    Optionally specify the   VCS branch   within your VCS repository where HCP Terraform should import new versions of policies  If you do not set this field  HCP Terraform uses your selected VCS repository s default branch  1     VCS Only    Specify where your policy set files live using the   Policies path    This lets you maintain multiple policy sets within a single repository  Use a relative path from your root directory to the directory that contains either the  sentinel hcl   Sentinel  or  policies hcl   OPA  configuration files  If you do not set this field  HCP Terraform uses the repository s root directory  1     Managed Policies Only    Select managed   Policies   to add to the policy set  You can only add policies written with the same policy framework you selected for this set  1  Choose a descriptive and unique   Name   for the policy set  You can use any combination of letters  numbers       and      1  Write an optional   Description   that tells other users about the purpose of the policy set and what it contains       Edit policy sets  To edit a policy set   1  Go to the   Policy Sets   section of your organization s settings  1  Click the policy set you want to edit to go to its settings page  1  Adjust the settings and click   Update policy set         Evaluate a policy runtime upgrade  You can validate that changing a policy runtime version does not introduce any breaking changes   To perform a policy evaluation   1  Go to the   Policy Sets   section of your organization s settings  1  Click the policy set you want to upgrade  1  Click the   Evaluate   tab  1  Select the   Runtime version   you wish to upgrade to  1  Select a   Workspace   to test the policy and upgraded version against  1  Click   Evaluate     HCP Terraform will execute the policy set using the specified version and the latest plan data for the selected workspace  It will display the evaluation results  If the evaluation returns a  Failed  status  inspect the JSON output to determine whether the issue is related to a non compliant resource or is due to a syntax issue  If the evaluation results in an error  check that the policy configuration is valid       Delete policy sets       Warning    Deleting a policy set that applies to an active run causes that run s policy evaluation stage to error  We recommend warning other members of your organization before you delete widely used policy sets   You can not restore policy sets after deletion  You must manually re add them to HCP Terraform   To delete a policy set   1  Go to   Policy Sets   in your organization s settings  2  Click the policy set you want to delete to go to its details page  3  Click   Delete policy   and then click   Yes  delete policy set   to confirm   The policy set no longer appears on the UI and HCP Terraform no longer applies it to any workspaces  For managed policy sets  all of the individual policies are still available in HCP Terraform  You must delete each policy individually to remove it from your organization        Sentinel only  Sentinel parameters   Sentinel parameters  https   docs hashicorp com sentinel language parameters  are a list of key value pairs that HCP Terraform sends to the Sentinel runtime when performing policy checks on workspaces  If the value parses as JSON  HCP Terraform sends it to Sentinel as the corresponding type  string  boolean  integer  map  or list   If the value fails JSON validation  HCP Terraform sends it as a string   You can set Sentinel parameters when you  edit a policy set   edit policy sets


terraform Sentinel Policy Set VCS Repositories To enable policy enforcement you must group Sentinel policies into policy sets You can then apply those policy sets globally or to specific projects terraform cloud docs projects manage and workspaces page title Policy Set VCS Repositories Sentinel HCP Terraform Configure a Sentinel policy set version control repository to use in HCP Terraform A policy set repository has a configuration file policy files and module files

Answer:
---
page_title: Policy Set VCS Repositories - Sentinel - HCP Terraform
description: >-
 Configure a Sentinel policy set version control repository to use in HCP Terraform. A policy set repository has a configuration file, policy files, and module files.
---

# Sentinel Policy Set VCS Repositories

To enable policy enforcement, you must group Sentinel policies into policy sets. You can then apply those policy sets globally or to specific [projects](/terraform/cloud-docs/projects/manage) and workspaces.

<!-- BEGIN: TFC:only name:pnp-callout -->
@include 'tfc-package-callouts/policies.mdx'
<!-- END: TFC:only name:pnp-callout -->

One way to create policy sets is by connecting HCP Terraform to a version control repository. When you push changes to the repository, HCP Terraform automatically uses the updated policy set. Refer to [Managing Policy Sets](/terraform/cloud-docs/policy-enforcement/manage-policy-sets) for more details.

A Sentinel policy set repository contains a Sentinel configuration file, policy files, and module files.

## Configuration File

Your repository must contain a configuration file named `sentinel.hcl` that defines the following features of the policy set:

- Each policy included in the set. The policy name must match the names of individual [policy code files](#policy-code-files) exactly. HCP Terraform ignores policy files in the repository that are not listed in the configuration file. For each policy, the configuration file must designate the policy’s [enforcement level](/terraform/cloud-docs/policy-enforcement/manage-policy-sets#policy-enforcement-levels) and [source](#policy-source).
- [Terraform modules](#modules) that policies in the set need to access.

The following example shows a portion of a `sentinel.hcl` configuration file that defines a policy named `terraform-maintenance-windows`. The policy has a `hard-mandatory` enforcement level, meaning that it can block Terraform runs when it fails and users cannot override it.

```hcl
policy "terraform-maintenance-windows" {
 source            = "./terraform-maintenance-windows.sentinel"
 enforcement_level = "hard-mandatory"
}
```

To configure a module, add a `module` entry to your `sentinel.hcl` file. The following example adds a module called `timezone`.

```hcl
module "timezone" {
 source = "./modules/timezone.sentinel"
}
```

The repositories for [policy libraries on the Terraform Registry](https://registry.terraform.io/browse/policies) contain more examples.

## Policy Code Files

Define each Sentinel policy in a separate file within your repository. All local policy files must reside in the same directory as the `sentinel.hcl` configuration file and end with the `.sentinel` suffix.

### Policy Source

A policy's `source` field can either reference a file within the policy repository, or it can reference a remote source. For example, the configuration could reference a policy from HashiCorp's [foundational policies library](https://github.com/hashicorp/terraform-foundational-policies-library). Sentinel only supports HTTP and HTTPS remote sources.

To specify a local source, prefix the `source` with a `./`, or `../`. The following example shows how to reference a local source policy called `terraform-maintenance-windows.sentinel`.

```hcl
policy "terraform-maintenance-windows" {
 source            = "./terraform-maintenance-windows.sentinel"
 enforcement_level = "hard-mandatory"
}
```

To specify a remote source, supply the URL as the `source`. The following example references a policy from HashiCorp's foundational policies library.

```hcl
policy "deny-public-ssh-nsg-rules" {
  source = "https://registry.terraform.io/v2/policies/hashicorp/azure-networking-terraform/1.0.2/policy/deny-public-ssh-nsg-rules.sentinel?checksum=sha256:75c95bf1d6eb48153cb31f15c49c237bf7829549beebe20effa07bcdd3f3cb74"
  enforcement_level = "advisory"
}
```

For GitHub, you must use the URL of the raw policy content. Other URL types cause HCP Terraform to error when checking the policy. For example, do not use `https://github.com/hashicorp/policy-library-azure-networking-terraform/blob/main/policies/deny-public-ssh-nsg-rules/deny-public-ssh-nsg-rules.sentinel`.

To access the raw URL, open the Sentinel file in your Github repository, right-click **Raw** on the top right of the page, and save the link address.

### Example Policy

The following example policy uses the `time` and `tfrun` imports and a custom `timezone` module to do the following tasks:

1. Load the time when the Terraform run occurred
1. Convert the loaded time with the correct offset using the [Timezone API](https://timezoneapi.io/)
1. Verify that the provisioning operation occurs only on a specific day

The example policy also uses a [rule expression](https://docs.hashicorp.com/sentinel/language/spec#rule-expressions) with the `when` predicate. If the value of `tfrun.workspace.auto_apply` is false, the rule is not evaluated and returns true.

Finally, the example uses parameters to facilitate module reuse within Terraform. Refer to the [Sentinel parameter documentation](https://docs.hashicorp.com/sentinel/language/parameters) for details.

```hcl
import "time"
import "tfrun"
import "timezone"

param token default "WbNKULOBheqV"
param maintenance_days default ["Friday", "Saturday", "Sunday"]
param timezone_id default "America/Los_Angeles"

tfrun_created_at = time.load(tfrun.created_at)

supported_maintenance_day = rule when tfrun.workspace.auto_apply is true {
  tfrun_created_at.add(time.hour * timezone.offset(timezone_id, token)).weekday_name in maintenance_days
}

main = rule {
  supported_maintenance_day
}
```

To expand the policy, you could use the [time.hour](https://docs.hashicorp.com/sentinel/imports/time#time-hour) function to also restrict provisioning to specific times of day.

## Modules

HCP Terraform supports [Sentinel modules](https://docs.hashicorp.com/sentinel/extending/modules). Modules let you write reusable policy code that you can import and use within several policies at once.

You can store modules locally or retrieve them from a remote HTTP or HTTPS source.

-> **Note:** We recommend reviewing [Sentinel runtime's modules documentation](https://docs.hashicorp.com/sentinel/extending/modules) to learn how to use modules within Sentinel. However, the configuration examples in the runtime documentation are relevant to the Sentinel CLI and not HCP Terraform.

The following example module loads the code at `./modules/timezone.sentinel` relative to the policy set working directory. Other modules can access this code with the statement `import "timezone"`.

```hcl
import "http"
import "json"
import "decimal"

httpGet = func(id, token){
  uri = "https://timezoneapi.io/api/timezone/?" + id + "&token=" + token
  request = http.get(uri)
  return json.unmarshal(request.body)
}

offset = func(id, token) {
  tz = httpGet(id, token)
  offset = decimal.new(tz.data.datetime.offset_hours).int
  return offset
}
``

page title  Policy Set VCS Repositories   Sentinel   HCP Terraform description      Configure a Sentinel policy set version control repository to use in HCP Terraform  A policy set repository has a configuration file  policy files  and module files          Sentinel Policy Set VCS Repositories  To enable policy enforcement  you must group Sentinel policies into policy sets  You can then apply those policy sets globally or to specific  projects   terraform cloud docs projects manage  and workspaces        BEGIN  TFC only name pnp callout      include  tfc package callouts policies mdx       END  TFC only name pnp callout      One way to create policy sets is by connecting HCP Terraform to a version control repository  When you push changes to the repository  HCP Terraform automatically uses the updated policy set  Refer to  Managing Policy Sets   terraform cloud docs policy enforcement manage policy sets  for more details   A Sentinel policy set repository contains a Sentinel configuration file  policy files  and module files      Configuration File  Your repository must contain a configuration file named  sentinel hcl  that defines the following features of the policy set     Each policy included in the set  The policy name must match the names of individual  policy code files   policy code files  exactly  HCP Terraform ignores policy files in the repository that are not listed in the configuration file  For each policy  the configuration file must designate the policy s  enforcement level   terraform cloud docs policy enforcement manage policy sets policy enforcement levels  and  source   policy source      Terraform modules   modules  that policies in the set need to access   The following example shows a portion of a  sentinel hcl  configuration file that defines a policy named  terraform maintenance windows   The policy has a  hard mandatory  enforcement level  meaning that it can block Terraform runs when it fails and users cannot override it      hcl policy  terraform maintenance windows     source                 terraform maintenance windows sentinel   enforcement level    hard mandatory         To configure a module  add a  module  entry to your  sentinel hcl  file  The following example adds a module called  timezone       hcl module  timezone     source      modules timezone sentinel         The repositories for  policy libraries on the Terraform Registry  https   registry terraform io browse policies  contain more examples      Policy Code Files  Define each Sentinel policy in a separate file within your repository  All local policy files must reside in the same directory as the  sentinel hcl  configuration file and end with the   sentinel  suffix       Policy Source  A policy s  source  field can either reference a file within the policy repository  or it can reference a remote source  For example  the configuration could reference a policy from HashiCorp s  foundational policies library  https   github com hashicorp terraform foundational policies library   Sentinel only supports HTTP and HTTPS remote sources   To specify a local source  prefix the  source  with a       or        The following example shows how to reference a local source policy called  terraform maintenance windows sentinel       hcl policy  terraform maintenance windows     source                 terraform maintenance windows sentinel   enforcement level    hard mandatory         To specify a remote source  supply the URL as the  source   The following example references a policy from HashiCorp s foundational policies library      hcl policy  deny public ssh nsg rules      source    https   registry terraform io v2 policies hashicorp azure networking terraform 1 0 2 policy deny public ssh nsg rules sentinel checksum sha256 75c95bf1d6eb48153cb31f15c49c237bf7829549beebe20effa07bcdd3f3cb74    enforcement level    advisory         For GitHub  you must use the URL of the raw policy content  Other URL types cause HCP Terraform to error when checking the policy  For example  do not use  https   github com hashicorp policy library azure networking terraform blob main policies deny public ssh nsg rules deny public ssh nsg rules sentinel    To access the raw URL  open the Sentinel file in your Github repository  right click   Raw   on the top right of the page  and save the link address       Example Policy  The following example policy uses the  time  and  tfrun  imports and a custom  timezone  module to do the following tasks   1  Load the time when the Terraform run occurred 1  Convert the loaded time with the correct offset using the  Timezone API  https   timezoneapi io   1  Verify that the provisioning operation occurs only on a specific day  The example policy also uses a  rule expression  https   docs hashicorp com sentinel language spec rule expressions  with the  when  predicate  If the value of  tfrun workspace auto apply  is false  the rule is not evaluated and returns true   Finally  the example uses parameters to facilitate module reuse within Terraform  Refer to the  Sentinel parameter documentation  https   docs hashicorp com sentinel language parameters  for details       hcl import  time  import  tfrun  import  timezone   param token default  WbNKULOBheqV  param maintenance days default   Friday    Saturday    Sunday   param timezone id default  America Los Angeles   tfrun created at   time load tfrun created at   supported maintenance day   rule when tfrun workspace auto apply is true     tfrun created at add time hour   timezone offset timezone id  token   weekday name in maintenance days    main   rule     supported maintenance day        To expand the policy  you could use the  time hour  https   docs hashicorp com sentinel imports time time hour  function to also restrict provisioning to specific times of day      Modules  HCP Terraform supports  Sentinel modules  https   docs hashicorp com sentinel extending modules   Modules let you write reusable policy code that you can import and use within several policies at once   You can store modules locally or retrieve them from a remote HTTP or HTTPS source        Note    We recommend reviewing  Sentinel runtime s modules documentation  https   docs hashicorp com sentinel extending modules  to learn how to use modules within Sentinel  However  the configuration examples in the runtime documentation are relevant to the Sentinel CLI and not HCP Terraform   The following example module loads the code at    modules timezone sentinel  relative to the policy set working directory  Other modules can access this code with the statement  import  timezone        hcl import  http  import  json  import  decimal   httpGet   func id  token     uri    https   timezoneapi io api timezone      id     token     token   request   http get uri    return json unmarshal request body     offset   func id  token      tz   httpGet id  token    offset   decimal new tz data datetime offset hours  int   return offset


terraform page title tfstate v2 Imports Sentinel HCP Terraform Sentinel import designed specifically for Terraform 0 12 This import requires Terraform 0 12 or higher and must currently be loaded by path using an alias The tfstate v2 import provides access to a Terraform state Note This is documentation for the next version of the tfstate example import tfstate v2 as tfstate

Answer:
---
page_title: tfstate/v2 - Imports - Sentinel - HCP Terraform
description: The tfstate/v2 import provides access to a Terraform state.
---

-> **Note:** This is documentation for the next version of the `tfstate`
Sentinel import, designed specifically for Terraform 0.12. This import requires
Terraform 0.12 or higher, and must currently be loaded by path, using an alias,
example: `import "tfstate/v2" as tfstate`.

# Import: tfstate/v2

The `tfstate/v2` import provides access to a Terraform state.

<!-- BEGIN: TFC:only name:pnp-callout -->
@include 'tfc-package-callouts/policies.mdx'
<!-- END: TFC:only name:pnp-callout -->

The _state_ is the data that Terraform has recorded about a workspace at a
particular point in its lifecycle, usually after an apply. You can read more
general information about how Terraform uses state
[here](/terraform/language/state).

-> **NOTE:** Since HCP Terraform currently only supports policy checks at plan
time, the usefulness of this import is somewhat limited, as it will usually give
you the state _prior_ to the plan the policy check is currently being run for.
Depending on your needs, you may find the
[`planned_values`](/terraform/cloud-docs/policy-enforcement/sentinel/import/tfplan-v2#the-planned_values-collection) collection in
`tfplan/v2` more useful, which will give you a _predicted_ state by applying
plan data to the data found here. The one exception to this rule is _data
sources_, which will always give up to date data here, as long as the data
source could be evaluated at plan time.

The data in the `tfstate/v2` import is sourced from the JSON configuration file
that is generated by the [`terraform show -json`](/terraform/cli/commands/show#json-output) command. For more information on
the file format, see the [JSON Output Format](/terraform/internals/json-format)
page.

## Import Overview

The `tfstate/v2` import is structured as currently two _collections_, keyed in
resource address and output name, respectively.

```
(tfstate/v2)
├── terraform_version (string)
├── resources
│   └── (indexed by address)
│       ├── address (string)
│       ├── module_address (string)
│       ├── mode (string)
│       ├── type (string)
│       ├── name (string)
│       ├── index (float (number) or string)
│       ├── provider_name (string)
│       ├── values (map)
│       ├── depends_on (list of strings)
│       ├── tainted (boolean)
│       └── deposed_key (string)
└── outputs
    └── (indexed by name)
        ├── name (string)
        ├── sensitive (boolean)
        └── value (value)
```

The collections are:

* [`resources`](#the-resources-collection) - The state of all resources across
  all modules in the state.
* [`outputs`](#the-outputs-collection) - The state of all outputs from the root module in the state.

These collections are specifically designed to be used with the
[`filter`](https://docs.hashicorp.com/sentinel/language/collection-operations#filter-expression)
quantifier expression in Sentinel, so that one can collect a list of resources
to perform policy checks on without having to write complex module traversal. As
an example, the following code will return all `aws_instance` resource types
within the state, regardless of what module they are in:

```
all_aws_instances = filter tfstate.resources as _, r {
	r.mode is "managed" and
		r.type is "aws_instance"
}
```

You can add specific attributes to the filter to narrow the search, such as the
module address. The following code would return resources in a module named
`foo` only:

```
all_aws_instances = filter tfstate.resources as _, r {
	r.module_address is "module.foo" and
		r.mode is "managed" and
		r.type is "aws_instance"
}
```

## The `terraform_version` Value

The top-level `terraform_version` value in this import gives the Terraform
version that recorded the state. This can be used to do version validation.

```
import "tfstate/v2" as tfstate
import "strings"

v = strings.split(tfstate.terraform_version, ".")
version_major = int(v[1])
version_minor = int(v[2])

main = rule {
	version_major is 12 and version_minor >= 19
}
```

-> **NOTE:** The above example will give errors when working with pre-release
versions (example: `0.12.0beta1`). Future versions of this import will include
helpers to assist with processing versions that will account for these kinds of
exceptions.

## The `resources` Collection

The `resources` collection is a collection representing all of the resources in
the state, across all modules.

This collection is indexed on the complete resource address as the key.

An element in the collection has the following values:

* `address` - The absolute resource address - also the key for the collection's
  index.

* `module_address` - The address portion of the absolute resource address.

* `mode` - The resource mode, either `managed` (resources) or `data` (data
  sources).

* `type` - The resource type, example: `aws_instance` for `aws_instance.foo`.

* `name` - The resource name, example: `foo` for `aws_instance.foo`.

* `index` - The resource index. Can be either a number or a string.

* `provider_name` - The name of the provider this resource belongs to. This
  allows the provider to be interpreted unambiguously in the unusual situation
  where a provider offers a resource type whose name does not start with its own
  name, such as the `googlebeta` provider offering `google_compute_instance`.

  -> **Note:** Starting with Terraform 0.13, the `provider_name` field contains the
  _full_ source address to the provider in the Terraform Registry. Example:
  `registry.terraform.io/hashicorp/null` for the null provider.

* `values` - An object (map) representation of the attribute values of the
  resource, whose structure depends on the resource type schema. When accessing
  proposed state through the [`planned_values`](/terraform/cloud-docs/policy-enforcement/sentinel/import/tfplan-v2#the-planned_values-collection)
  collection of the tfplan/v2 import, unknown values will be omitted.

* `depends_on` - The addresses of the resources that this resource depends on.

* `tainted` - `true` if the resource has been explicitly marked as
  [tainted](/terraform/cli/commands/taint) in the state.

* `deposed_key` - Set if the resource has been marked deposed and will be
  destroyed on the next apply. This matches the deposed field in the
  [`resource_changes`](/terraform/cloud-docs/policy-enforcement/sentinel/import/tfplan-v2#the-resource_changes-collection)
  collection in the [`tfplan/v2`](/terraform/cloud-docs/policy-enforcement/sentinel/import/tfplan-v2) import.

## The `outputs` Collection

The `outputs` collection is a collection of outputs from the root module of the
state.

Note that no child modules are included in this output set, and there is no way
to fetch child module output values. This is to encourage the correct flow of
outputs to the recommended root consumption level.

The collection is indexed on the output name, with the following fields:

* `name`: The name of the output, also the collection key.
* `sensitive`: Whether or not the value was marked as
  [sensitive](/terraform/language/values/outputs#sensitive-suppressing-values-in-cli-output)
  in
  configuration.
* `value`: The value of the output.

page title  tfstate v2   Imports   Sentinel   HCP Terraform description  The tfstate v2 import provides access to a Terraform state            Note    This is documentation for the next version of the  tfstate  Sentinel import  designed specifically for Terraform 0 12  This import requires Terraform 0 12 or higher  and must currently be loaded by path  using an alias  example   import  tfstate v2  as tfstate      Import  tfstate v2  The  tfstate v2  import provides access to a Terraform state        BEGIN  TFC only name pnp callout      include  tfc package callouts policies mdx       END  TFC only name pnp callout      The  state  is the data that Terraform has recorded about a workspace at a particular point in its lifecycle  usually after an apply  You can read more general information about how Terraform uses state  here   terraform language state         NOTE    Since HCP Terraform currently only supports policy checks at plan time  the usefulness of this import is somewhat limited  as it will usually give you the state  prior  to the plan the policy check is currently being run for  Depending on your needs  you may find the   planned values    terraform cloud docs policy enforcement sentinel import tfplan v2 the planned values collection  collection in  tfplan v2  more useful  which will give you a  predicted  state by applying plan data to the data found here  The one exception to this rule is  data sources   which will always give up to date data here  as long as the data source could be evaluated at plan time   The data in the  tfstate v2  import is sourced from the JSON configuration file that is generated by the   terraform show  json    terraform cli commands show json output  command  For more information on the file format  see the  JSON Output Format   terraform internals json format  page      Import Overview  The  tfstate v2  import is structured as currently two  collections   keyed in resource address and output name  respectively        tfstate v2      terraform version  string      resources          indexed by address              address  string              module address  string              mode  string              type  string              name  string              index  float  number  or string              provider name  string              values  map              depends on  list of strings              tainted  boolean              deposed key  string      outputs          indexed by name              name  string              sensitive  boolean              value  value       The collections are       resources    the resources collection    The state of all resources across   all modules in the state      outputs    the outputs collection    The state of all outputs from the root module in the state   These collections are specifically designed to be used with the   filter   https   docs hashicorp com sentinel language collection operations filter expression  quantifier expression in Sentinel  so that one can collect a list of resources to perform policy checks on without having to write complex module traversal  As an example  the following code will return all  aws instance  resource types within the state  regardless of what module they are in       all aws instances   filter tfstate resources as    r    r mode is  managed  and   r type is  aws instance         You can add specific attributes to the filter to narrow the search  such as the module address  The following code would return resources in a module named  foo  only       all aws instances   filter tfstate resources as    r    r module address is  module foo  and   r mode is  managed  and   r type is  aws instance            The  terraform version  Value  The top level  terraform version  value in this import gives the Terraform version that recorded the state  This can be used to do version validation       import  tfstate v2  as tfstate import  strings   v   strings split tfstate terraform version       version major   int v 1   version minor   int v 2    main   rule    version major is 12 and version minor    19             NOTE    The above example will give errors when working with pre release versions  example   0 12 0beta1    Future versions of this import will include helpers to assist with processing versions that will account for these kinds of exceptions      The  resources  Collection  The  resources  collection is a collection representing all of the resources in the state  across all modules   This collection is indexed on the complete resource address as the key   An element in the collection has the following values      address    The absolute resource address   also the key for the collection s   index      module address    The address portion of the absolute resource address      mode    The resource mode  either  managed   resources  or  data   data   sources       type    The resource type  example   aws instance  for  aws instance foo       name    The resource name  example   foo  for  aws instance foo       index    The resource index  Can be either a number or a string      provider name    The name of the provider this resource belongs to  This   allows the provider to be interpreted unambiguously in the unusual situation   where a provider offers a resource type whose name does not start with its own   name  such as the  googlebeta  provider offering  google compute instance           Note    Starting with Terraform 0 13  the  provider name  field contains the    full  source address to the provider in the Terraform Registry  Example     registry terraform io hashicorp null  for the null provider      values    An object  map  representation of the attribute values of the   resource  whose structure depends on the resource type schema  When accessing   proposed state through the   planned values    terraform cloud docs policy enforcement sentinel import tfplan v2 the planned values collection    collection of the tfplan v2 import  unknown values will be omitted      depends on    The addresses of the resources that this resource depends on      tainted     true  if the resource has been explicitly marked as    tainted   terraform cli commands taint  in the state      deposed key    Set if the resource has been marked deposed and will be   destroyed on the next apply  This matches the deposed field in the     resource changes    terraform cloud docs policy enforcement sentinel import tfplan v2 the resource changes collection    collection in the   tfplan v2    terraform cloud docs policy enforcement sentinel import tfplan v2  import      The  outputs  Collection  The  outputs  collection is a collection of outputs from the root module of the state   Note that no child modules are included in this output set  and there is no way to fetch child module output values  This is to encourage the correct flow of outputs to the recommended root consumption level   The collection is indexed on the output name  with the following fields      name   The name of the output  also the collection key     sensitive   Whether or not the value was marked as    sensitive   terraform language values outputs sensitive suppressing values in cli output    in   configuration     value   The value of the output


terraform The tfrun import provides access to data associated with a Terraform run The tfrun import provides access to data associated with a Terraform run run glossary BEGIN TFC only name pnp callout page title tfrun Imports Sentinel HCP Terraform Import tfrun

Answer:
---
page_title: tfrun - Imports - Sentinel - HCP Terraform
description: The `tfrun` import provides access to data associated with a Terraform run.
---

# Import: tfrun

The `tfrun` import provides access to data associated with a [Terraform run][run-glossary].

<!-- BEGIN: TFC:only name:pnp-callout -->
@include 'tfc-package-callouts/policies.mdx'
<!-- END: TFC:only name:pnp-callout -->

This import currently consists of run attributes, as well as namespaces for the `organization`, `workspace` and `cost-estimate`. Each namespace provides static data regarding the HCP Terraform application that can then be consumed by Sentinel during a policy evaluation.

```
tfrun
├── id (string)
├── created_at (string)
├── created_by (string)
├── message (string)
├── commit_sha (string)
├── is_destroy (boolean)
├── refresh (boolean)
├── refresh_only (boolean)
├── replace_addrs (array of strings)
├── speculative (boolean)
├── target_addrs (array of strings)
├── project
│   ├── id (string)
│   └── name (string)
├── variables (map of keys)
├── organization
│   └── name (string)
├── workspace
│   ├── id (string)
│   ├── name (string)
│   ├── created_at (string)
│   ├── description (string)
│   ├── execution_mode (string)
│   ├── auto_apply (bool)
│   ├── tags (array of strings)
|   ├── tag_bindings (array of objects)
│   ├── working_directory (string)
│   └── vcs_repo (map of keys)
└── cost_estimate
    ├── prior_monthly_cost (string)
    ├── proposed_monthly_cost (string)
    └── delta_monthly_cost (string)
```

-> **Note:** When writing policies using this import, keep in mind that workspace
data is generally editable by users outside of the context of policy
enforcement. For example, consider the case of omitting the enforcement of
policy rules for development workspaces by the workspace name (allowing the
policy to pass if the workspace ends in `-dev`). While this is useful for
extremely granular exceptions, the workspace name could be edited by
workspace admins, effectively bypassing the policy. In this case, where an
extremely strict separation of policy managers vs. workspace practitioners is
required, using [policy sets](/terraform/cloud-docs/policy-enforcement/manage-policy-sets)
to only enforce the policy on non-development workspaces is more appropriate.

[run-glossary]: /terraform/docs/glossary#run

[workspace-glossary]: /terraform/docs/glossary#workspace

## Namespace: root

The **root namespace** contains data associated with the current run.

### Value: `id`

* **Value Type:** String.

Specifies the ID that is associated with the current Terraform run.

### Value: `created_at`

* **Value Type:** String.

The `created_at` value within the [root namespace](#namespace-root) specifies the time that the run was created. The timestamp returned follows the format outlined in [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339).

Users can use the `time` import to [load](https://docs.hashicorp.com/sentinel/imports/time#time-load-timeish) a run timestamp and create a new timespace from the specified value. See the `time` import [documentation](https://docs.hashicorp.com/sentinel/imports/time#import-time) for available actions that can be performed on timespaces.

### Value: `created_by`

* **Value Type:** String.

The `created_by` value within the [root namespace](#namespace-root) is string that specifies the user name of the HCP Terraform user for the specific run.

### Value: `message`

* **Value Type:** String.

Specifies the message that is associated with the Terraform run.

The default value is _"Queued manually via the Terraform Enterprise API"_.

### Value: `commit_sha`

* **Value Type:** String.

Specifies the checksum hash (SHA) that identifies the commit.

### Value: `is_destroy`

* **Value Type:** Boolean.

Specifies if the plan is a destroy plan, which will destroy all provisioned resources.

### Value: `refresh`

* **Value Type:** Boolean.

Specifies whether the state was refreshed prior to the plan.

### Value: `refresh_only`

* **Value Type:** Boolean.

Specifies whether the plan is in refresh-only mode, which ignores configuration changes and updates state with any changes made outside of Terraform.

### Value: `replace_addrs`

* **Value Type:** An array of strings representing [resource addresses](/terraform/cli/state/resource-addressing).

Provides the targets specified using the [`-replace`](/terraform/cli/commands/plan#resource-targeting) flag in the CLI or the `replace-addrs` attribute in the API. Will be null if no resource targets are specified.

### Value: `speculative`

* **Value Type:** Boolean.

Specifies whether the plan associated with the run is a [speculative plan](/terraform/cloud-docs/run/remote-operations#speculative-plans) only.

### Value: `target_addrs`

* **Value Type:** An array of strings representing [resource addresses](/terraform/cli/state/resource-addressing).

Provides the targets specified using the [`-target`](/terraform/cli/commands/plan#resource-targeting) flag in the CLI or the `target-addrs` attribute in the API. Will be null if no resource targets are specified.

To prohibit targeted runs altogether, make sure the `target_addrs` value is null or empty:

```
import "tfrun"

main = tfrun.target_addrs is null or tfrun.target_addrs is empty
```

### Value: `variables`

* **Value Type:** A string-keyed map of values.

Provides the names of the variables that are configured within the run and the [sensitivity](/terraform/cloud-docs/workspaces/variables/managing-variables#sensitive-values) state of the value.

```
variables (map of keys)
└── name (string)
    └── category (string)
    └── sensitive (boolean)
```

## Namespace: project

The **project namespace** contains data associated with the current run's [projects](/terraform/cloud-docs/api-docs/projects).

### Value: `id`

* **Value Type:** String.

Specifies the ID that is associated with the current project.

### Value: `name`

* **Value Type:** String.

Specifies the name assigned to the HCP Terraform project.

## Namespace: organization

The **organization namespace** contains data associated with the current run's HCP Terraform [organization](/terraform/cloud-docs/users-teams-organizations/organizations).

### Value: `name`

* **Value Type:** String.

Specifies the name assigned to the HCP Terraform organization.

## Namespace: workspace

The **workspace namespace** contains data associated with the current run's workspace.

### Value: `id`

* **Value Type:** String.

Specifies the ID that is associated with the Terraform workspace.

### Value: `name`

* **Value Type:** String.

The name of the workspace, which can only include letters, numbers, `-`, and `_`.

As an example, in a workspace named `app-us-east-dev` the following policy would evaluate to `true`:

```
# Enforces production rules on all non-development workspaces

import "tfrun"
import "strings"

# (Actual policy logic omitted)
evaluate_production_policy = rule { ... }

main = rule when strings.has_suffix(tfrun.workspace.name, "-dev") is false {
    evaluate_production_policy
}
```

### Value: `created_at`

* **Value Type:** String.

Specifies the time that the workspace was created. The timestamp returned follows the format outlined in [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339).

Users can use the `time` import to [load](https://docs.hashicorp.com/sentinel/imports/time#time-load-timeish) a workspace timestamp, and create a new timespace from the specified value. See the `time` import [documentation](https://docs.hashicorp.com/sentinel/imports/time#import-time) for available actions that can be performed on timespaces.

### Value: `description`

* **Value Type:** String.

Contains the description for the workspace.

This value can be `null`.

### Value: `auto_apply`

* **Value Type:** Boolean.

Contains the workspace's [auto-apply](/terraform/cloud-docs/workspaces/settings#auto-apply-and-manual-apply) setting.

### Value: `tags`

* **Value Type:** Array of strings.

Contains the list of tag names for the workspace, as well as the keys from tag bindings.

### Value: `tag_bindings`

* **Value Type:** Array of objects.

Contains the complete list of tag bindings for the workspace, which includes inherited tag bindings, as well as the workspace key-only tags. Each binding has a string `key`, a nullable string `value`, as well as a boolean `inherited` properties.

```
tag_bindings (array of objects)
├── key (string)
├── value (string or null)
└── inherited (boolean)
```

### Value: `working_directory`

* **Value Type:** String.

Contains the configured [Terraform working directory](/terraform/cloud-docs/workspaces/settings#terraform-working-directory) of the workspace.

This value can be `null`.

### Value: `execution_mode`

* **Value Type:** String.

Contains the configured [Terraform execution mode](/terraform/cloud-docs/workspaces/settings#execution-mode) of the workspace.

The default value is `remote`.

### Value: `vcs_repo`

* **Value Type:** A string-keyed map of values.

Contains data associated with a VCS repository connected to the workspace.

Details regarding each attribute can be found in the documentation for the HCP Terraform [Workspaces API](/terraform/cloud-docs/api-docs/workspaces).

This value can be `null`.

```
vcs_repo (map of keys)
├── identifier (string)
├── display_identifier (string)
├── branch (string)
└── ingress_submodules (bool)
```

## Namespace: cost_estimate

The **cost_estimation namespace** contains data associated with the current run's cost estimate.

This namespace is only present if a cost estimate is available.

-> Cost estimation is disabled for runs using [resource targeting](/terraform/cli/commands/plan#resource-targeting), which may cause unexpected failures.

-> **Note:** Cost estimates are not available for Terraform 0.11.

### Value: `prior_monthly_cost`

* **Value Type:** String.

Contains the monthly cost estimate at the beginning of a plan.

This value contains a positive decimal and can be `"0.0"`.

### Value: `proposed_monthly_cost`

* **Value Type:** String.

Contains the monthly cost estimate if the plan were to be applied.

This value contains a positive decimal and can be `"0.0"`.

### Value: `delta_monthly_cost`

* **Value Type:** String.

Contains the difference between the prior and proposed monthly cost estimates.

This value may contain a positive or negative decimal and can be `"0.0"`.

page title  tfrun   Imports   Sentinel   HCP Terraform description  The  tfrun  import provides access to data associated with a Terraform run         Import  tfrun  The  tfrun  import provides access to data associated with a  Terraform run  run glossary         BEGIN  TFC only name pnp callout      include  tfc package callouts policies mdx       END  TFC only name pnp callout      This import currently consists of run attributes  as well as namespaces for the  organization    workspace  and  cost estimate   Each namespace provides static data regarding the HCP Terraform application that can then be consumed by Sentinel during a policy evaluation       tfrun     id  string      created at  string      created by  string      message  string      commit sha  string      is destroy  boolean      refresh  boolean      refresh only  boolean      replace addrs  array of strings      speculative  boolean      target addrs  array of strings      project         id  string          name  string      variables  map of keys      organization         name  string      workspace         id  string          name  string          created at  string          description  string          execution mode  string          auto apply  bool          tags  array of strings          tag bindings  array of objects          working directory  string          vcs repo  map of keys      cost estimate         prior monthly cost  string          proposed monthly cost  string          delta monthly cost  string            Note    When writing policies using this import  keep in mind that workspace data is generally editable by users outside of the context of policy enforcement  For example  consider the case of omitting the enforcement of policy rules for development workspaces by the workspace name  allowing the policy to pass if the workspace ends in   dev    While this is useful for extremely granular exceptions  the workspace name could be edited by workspace admins  effectively bypassing the policy  In this case  where an extremely strict separation of policy managers vs  workspace practitioners is required  using  policy sets   terraform cloud docs policy enforcement manage policy sets  to only enforce the policy on non development workspaces is more appropriate    run glossary    terraform docs glossary run   workspace glossary    terraform docs glossary workspace     Namespace  root  The   root namespace   contains data associated with the current run       Value   id       Value Type    String   Specifies the ID that is associated with the current Terraform run       Value   created at       Value Type    String   The  created at  value within the  root namespace   namespace root  specifies the time that the run was created  The timestamp returned follows the format outlined in  RFC3339  https   datatracker ietf org doc html rfc3339    Users can use the  time  import to  load  https   docs hashicorp com sentinel imports time time load timeish  a run timestamp and create a new timespace from the specified value  See the  time  import  documentation  https   docs hashicorp com sentinel imports time import time  for available actions that can be performed on timespaces       Value   created by       Value Type    String   The  created by  value within the  root namespace   namespace root  is string that specifies the user name of the HCP Terraform user for the specific run       Value   message       Value Type    String   Specifies the message that is associated with the Terraform run   The default value is   Queued manually via the Terraform Enterprise API         Value   commit sha       Value Type    String   Specifies the checksum hash  SHA  that identifies the commit       Value   is destroy       Value Type    Boolean   Specifies if the plan is a destroy plan  which will destroy all provisioned resources       Value   refresh       Value Type    Boolean   Specifies whether the state was refreshed prior to the plan       Value   refresh only       Value Type    Boolean   Specifies whether the plan is in refresh only mode  which ignores configuration changes and updates state with any changes made outside of Terraform       Value   replace addrs       Value Type    An array of strings representing  resource addresses   terraform cli state resource addressing    Provides the targets specified using the    replace    terraform cli commands plan resource targeting  flag in the CLI or the  replace addrs  attribute in the API  Will be null if no resource targets are specified       Value   speculative       Value Type    Boolean   Specifies whether the plan associated with the run is a  speculative plan   terraform cloud docs run remote operations speculative plans  only       Value   target addrs       Value Type    An array of strings representing  resource addresses   terraform cli state resource addressing    Provides the targets specified using the    target    terraform cli commands plan resource targeting  flag in the CLI or the  target addrs  attribute in the API  Will be null if no resource targets are specified   To prohibit targeted runs altogether  make sure the  target addrs  value is null or empty       import  tfrun   main   tfrun target addrs is null or tfrun target addrs is empty          Value   variables       Value Type    A string keyed map of values   Provides the names of the variables that are configured within the run and the  sensitivity   terraform cloud docs workspaces variables managing variables sensitive values  state of the value       variables  map of keys      name  string          category  string          sensitive  boolean          Namespace  project  The   project namespace   contains data associated with the current run s  projects   terraform cloud docs api docs projects        Value   id       Value Type    String   Specifies the ID that is associated with the current project       Value   name       Value Type    String   Specifies the name assigned to the HCP Terraform project      Namespace  organization  The   organization namespace   contains data associated with the current run s HCP Terraform  organization   terraform cloud docs users teams organizations organizations        Value   name       Value Type    String   Specifies the name assigned to the HCP Terraform organization      Namespace  workspace  The   workspace namespace   contains data associated with the current run s workspace       Value   id       Value Type    String   Specifies the ID that is associated with the Terraform workspace       Value   name       Value Type    String   The name of the workspace  which can only include letters  numbers       and       As an example  in a workspace named  app us east dev  the following policy would evaluate to  true          Enforces production rules on all non development workspaces  import  tfrun  import  strings      Actual policy logic omitted  evaluate production policy   rule          main   rule when strings has suffix tfrun workspace name    dev   is false       evaluate production policy            Value   created at       Value Type    String   Specifies the time that the workspace was created  The timestamp returned follows the format outlined in  RFC3339  https   datatracker ietf org doc html rfc3339    Users can use the  time  import to  load  https   docs hashicorp com sentinel imports time time load timeish  a workspace timestamp  and create a new timespace from the specified value  See the  time  import  documentation  https   docs hashicorp com sentinel imports time import time  for available actions that can be performed on timespaces       Value   description       Value Type    String   Contains the description for the workspace   This value can be  null        Value   auto apply       Value Type    Boolean   Contains the workspace s  auto apply   terraform cloud docs workspaces settings auto apply and manual apply  setting       Value   tags       Value Type    Array of strings   Contains the list of tag names for the workspace  as well as the keys from tag bindings       Value   tag bindings       Value Type    Array of objects   Contains the complete list of tag bindings for the workspace  which includes inherited tag bindings  as well as the workspace key only tags  Each binding has a string  key   a nullable string  value   as well as a boolean  inherited  properties       tag bindings  array of objects      key  string      value  string or null      inherited  boolean           Value   working directory       Value Type    String   Contains the configured  Terraform working directory   terraform cloud docs workspaces settings terraform working directory  of the workspace   This value can be  null        Value   execution mode       Value Type    String   Contains the configured  Terraform execution mode   terraform cloud docs workspaces settings execution mode  of the workspace   The default value is  remote        Value   vcs repo       Value Type    A string keyed map of values   Contains data associated with a VCS repository connected to the workspace   Details regarding each attribute can be found in the documentation for the HCP Terraform  Workspaces API   terraform cloud docs api docs workspaces    This value can be  null        vcs repo  map of keys      identifier  string      display identifier  string      branch  string      ingress submodules  bool          Namespace  cost estimate  The   cost estimation namespace   contains data associated with the current run s cost estimate   This namespace is only present if a cost estimate is available      Cost estimation is disabled for runs using  resource targeting   terraform cli commands plan resource targeting   which may cause unexpected failures        Note    Cost estimates are not available for Terraform 0 11       Value   prior monthly cost       Value Type    String   Contains the monthly cost estimate at the beginning of a plan   This value contains a positive decimal and can be   0 0         Value   proposed monthly cost       Value Type    String   Contains the monthly cost estimate if the plan were to be applied   This value contains a positive decimal and can be   0 0         Value   delta monthly cost       Value Type    String   Contains the difference between the prior and proposed monthly cost estimates   This value may contain a positive or negative decimal and can be   0 0