HCP Terraform Now Has Pre-Written AWS and CIS Compliance Policies You Don't Have to Maintain

HCP Terraform now offers a native pre-written policy library — compliance policies for AWS Foundational Security Best Practices (AWS FSBP) and CIS Foundations Benchmark that teams can activate without writing or maintaining policy code. Azure and GCP policy libraries are in development. Currently in public beta.

The compliance policy problem in Terraform has two parts: writing the policies correctly (getting OPA/Rego or Sentinel syntax right, covering all the relevant resource types, handling edge cases) and maintaining them as the CIS benchmarks publish new versions and as your Terraform provider schemas evolve. Pre-written policies eliminate both steps for the covered frameworks.

What’s Available

Two frameworks at launch:

• AWS Foundational Security Best Practices (AWS FSBP) — AWS’s own curated set of security controls for their services, covering IAM, S3, EC2, RDS, Lambda, CloudTrail, and others
• CIS AWS Foundations Benchmark — Center for Internet Security’s benchmark for AWS, one of the most widely cited compliance frameworks for cloud infrastructure audits

Both are maintained by HashiCorp, which means version updates as the source frameworks change are handled upstream rather than by each platform team.

Policy Engine Support

The pre-written library works with both policy engines that HCP Terraform supports:

Sentinel (HashiCorp’s legacy policy language, still widely deployed): Teams running existing Sentinel policies can add pre-written policies alongside custom Sentinel rules in the same workspace policy set.

Terraform Policy (the newer HCL-based policy engine): Teams that have migrated to or are starting fresh with Terraform Policy can use pre-written policies in the same framework without mixing languages.

This dual-engine support matters because many organizations have significant existing Sentinel investment that they’re not ready to migrate.

Enforcement Modes

Advisory (default): Policy violations generate warnings in the plan output and are visible in the HCP Terraform UI, but do not block applies. Useful for a visibility-first rollout — see what’s currently out of compliance before deciding whether to enforce.

Mandatory: Policy violations block the apply. Resources that fail a mandatory policy cannot be provisioned until the configuration is brought into compliance or an exception is explicitly granted.

Combining Pre-Written and Custom Policies

Pre-written policies are read-only — they can’t be modified directly, which ensures they stay synchronized with the upstream benchmark. But they can be combined with custom Rego or Sentinel policies in the same policy set, which means teams can use the pre-written library as the baseline and add organization-specific rules on top.

This composition model is the practical deployment pattern for most organizations: the CIS benchmark covers the industry-standard baseline; custom policies cover internal requirements that aren’t in any public benchmark (internal tagging standards, approved regions, approved AMI registries).

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.