How to Apply Terraform's Pre-Written Sentinel Policies for ISO 27001 Compliance

Summary

• ISO 27001 compliance in Terraform environments previously required teams to write Sentinel policies from scratch — a resource-intensive task that blocked most teams from adopting policy-as-code
• HashiCorp and AWS jointly released pre-written Sentinel policies mapping to ISO/IEC 27001 Annex A controls across access control, cryptography, logging/monitoring, and secure configuration
• Policies are available via the Terraform Registry and apply directly in HCP Terraform (HashiCorp’s managed platform)
• This joins an existing library covering CIS Benchmarks, AWS Foundational Security Best Practices, NIST SP 800-53, and PCI DSS

Purpose

Sentinel is HashiCorp’s policy-as-code framework for Terraform — it allows platform teams to define governance rules that enforce compliance requirements before infrastructure is provisioned, not after. The challenge has been authoring: translating a compliance framework like ISO 27001 into enforceable Sentinel policies requires both compliance expertise and Terraform internals knowledge. Most teams have neither on the same person. These pre-written policies remove that barrier by providing a starting point that reflects real-world AWS security requirements, co-developed with AWS to ensure accuracy.

Pre-requisites

• HCP Terraform or Terraform Enterprise (Sentinel policy enforcement is not available in Terraform Community edition)
• AWS provider configured in your Terraform workspace
• HCP Terraform organization admin access to configure policy sets

Steps

1. Browse the Terraform Registry

Navigate to the Terraform Registry Policies section and filter for “ISO 27001” or “AWS ISO”. The co-authored HashiCorp/AWS policy sets will appear as verified publisher content.

2. Add the Policy Set to HCP Terraform

In HCP Terraform, go to your organization’s Settings → Policy Sets. Create a new policy set using the Registry source option, select the ISO 27001 policy set, and configure the enforcement mode:

• Advisory: violations are logged but don’t block terraform apply — useful for initial rollout and baselining
• Soft mandatory: violations block apply but can be overridden by authorized users with documented justification
• Hard mandatory: violations block apply with no override path

Start with Advisory mode to measure existing compliance posture before enforcing.

3. Scope the Policy Set

Assign the policy set to specific workspaces or workspace tags. For ISO 27001, the recommended approach is to apply the full policy set to workspaces managing production-tier infrastructure, and the cryptography/access control subsets to any workspace handling environments that process personal data or sensitive workloads.

4. Run a Plan and Review Violations

Run terraform plan in an affected workspace. The Sentinel output in HCP Terraform will display policy evaluation results — each violation references the ISO 27001 Annex A control it maps to. Review violations against your current AWS resource configurations.

5. Remediate and Re-evaluate

Address violations by updating Terraform resource configurations (e.g., enabling CloudTrail logging, enforcing KMS encryption on S3 buckets, restricting security group ingress rules). Re-run terraform plan to verify the policy checks pass before applying.

6. Transition to Soft Mandatory

Once Advisory mode shows consistent compliance, transition production workspaces to Soft mandatory. Soft mandatory preserves an escape hatch for emergency changes while creating an audit record of every override with a documented reason.

The Trap

Advisory mode becoming permanent. Teams commonly set policies to Advisory during rollout and never transition to enforcement because violations require remediation work. The policy set provides no compliance value in Advisory mode — it only reports what’s already known. Set a target date for transitioning production workspaces to at minimum Soft mandatory, and track that transition as an infrastructure milestone, not an optional cleanup task.

Cited References

• HashiCorp: Terraform Adds Pre-Written Sentinel Policies for ISO 27001
• Terraform Registry: Policy Sets
• HCP Terraform: Sentinel Policy Documentation
• ISO/IEC 27001:2022 Annex A Controls Reference

Photo by Mikhail Nilov on Pexels

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.