HCP Packer: Enforced Provisioners and the End of Governance by Trust

Machine image governance has a well-known failure mode: the platform team hardens the base image, the application team customizes it downstream, and somewhere in the middle the security controls get overwritten. HCP Packer’s new enforced provisioners feature closes that gap by making compliance steps mandatory at the infrastructure level, not the team convention level.

What Happened

HashiCorp released enforced provisioners for HCP Packer as a generally available feature this week. The mechanism allows platform and security teams to upload provisioner definitions centrally—via the HCP Packer UI or API—and link them to specific image buckets. When any team builds an image from that bucket, HCP Packer automatically retrieves and executes the configured provisioners as part of the build, regardless of what the calling template specifies.

Provisioner execution and versioning are tracked alongside the image version itself, creating an audit trail that shows which compliance controls were applied to each image build. The system supports both scripted and programmatic provisioner definitions.

Why It Matters for Platform Teams

The governance problem this solves is organizational, not technical. In organizations with distributed image ownership—where dozens of teams build application images from shared base templates—enforcing baseline controls through documentation or peer review creates compliance gaps that scale with team count. A policy that says “all images must run the CIS benchmark script” is only as reliable as the last team that remembered to include it.

Enforced provisioners move that control out of the template layer (where application teams have write access) and into the HCP Packer configuration layer (where platform teams control access). The application team doesn’t need to know the provisioner exists; the build applies it automatically.

The audit trail addresses the compliance reporting problem that typically accompanies image governance: demonstrating to auditors that specific controls were applied to every image in production. With enforced provisioners, the evidence is captured at build time against each image version, not reconstructed later from CI logs.

This fits into a broader pattern in the HashiCorp Cloud Platform of shifting governance from convention to enforcement—similar to HCP Terraform’s policy-as-code approach and Vault’s dynamic credential issuance. The common thread is removing the human compliance checkpoint from the critical path.

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.