/scaffold

Terraform Compliance And Policy-as-Code

Purpose: Use this file when you need static analysis, policy gates, custom validation, or Terraform linting rules.

Contents:

1. Tool matrix
2. Key tfsec / Checkov rules
3. OPA / Sentinel enforcement
4. Terraform built-in validation
5. Pre-commit and TFLint

Tool Matrix

Key tfsec / Checkov Rules

tfsec / Trivy examples

Checkov examples

OPA / Sentinel Enforcement

Required tags in policy examples:

• Environment
• Project
• ManagedBy

Security policy example should block unnecessary 0.0.0.0/0 ingress.

Sentinel enforcement levels:

Terraform Built-In Validation

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

Use lifecycle preconditions/postconditions for non-trivial invariants.

Pre-Commit And TFLint

Pre-commit should typically include:

• terraform_fmt
• terraform_validate
• terraform_tflint
• checkov or trivy

TFLint is the provider-aware linter for:

• invalid instance or database types
• naming conventions
• unused declarations