Exam Terraform Associate topic 1 question 104 discussion

A. With a Sentinel policy, which runs before every apply. Terraform Enterprise can enforce security controls through the use of Sentinel policies. Sentinel is a policy as code framework that integrates with Terraform Enterprise and can be used to enforce specific security controls. In this case, the Sentinel policy could check that all new S3 buckets are set to be private and encrypted at rest and prevent the Terraform apply from proceeding if the buckets do not meet this requirement. This ensures that the security control is automatically and proactively enforced every time Terraform makes changes to the infrastructure.

Answer, B only. They want to keep the S3 bucket private. So, it will be a different state file.

As per terraform document

AAAAAAAAAAA

A is correct

import "tfplan" # Ensure all new S3 buckets are private and encrypted at rest deny[msg] { resources := tfplan.module_paths["aws_s3_bucket"] not all_true([ for r in resources: r.attributes.acl == "private" and r.attributes.server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm == "AES256" ]) msg := "All new S3 buckets must be private and encrypted at rest" }

Terraform Enterprise provides the ability to enforce security controls through Sentinel policies, which are a form of policy as code. Sentinel policies allow you to define and enforce organizational or regulatory policies by creating a set of rules that run before each Terraform operation.

A is correct

yes A Corrct

yes A Corrct

Sentinel policy is the best way to manage multiple workspaces

I go with A.

With a Sentinel policy for sure.

A. Reference: https://docs.hashicorp.com/sentinel/intro/what https://medium.com/hashicorp-engineering/enforcing-aws-s3-security-best-practice-using-terraform-sentinel-ddcd181ff4b7