HashiCorp has introduced tfpolicy, a new HCL-based policy-as-code framework for Terraform, now available in public beta within HCP Terraform. It is designed to simplify and modernize infrastructure governance by integrating policy creation and enforcement directly into Terraform workflows, eliminating the need for separate tools and languages.
Terraform policy is a declarative, HCL-based policy as code framework that enables platform teams to define and enforce policies using a familiar language while introducing new governance capabilities designed for modern infrastructure systems.
Policy as code helps organizations codify governance requirements, automate compliance checks, and strengthen security outcomes. Existing solutions, such as HashiCorp Sentinel and Open Policy Agent (OPA) operate as separate layers that validate infrastructure against policy rules.
According to HashiCorp, these approaches often fails to incorporate key external context, such as relationships between resources, which can change throughout the infrastructure lifecycle. Instead, the new policy framework addresses the growing complexity of modern infrastructure, which often spans multiple clouds and services rather than individual resources.
Terraform tfpolicy is deeply integrated into Terraform and uses HCL, the same language that enables the creation of Terraform infrastructure, thus reducing the need to switch tools and languages and allowing teams to define and enforce policies within the same workflow they already use.
This deep integration brings governance closer to the infrastructure lifecycle, with policy evaluation before and after deployment. Teams can enforce requirements based on actual infrastructure state — not just planned changes — all within the familiar workflows and practices Terraform practitioners already use every day.
tfpolicy also introduces several new capabilities, such as evaluating policies based on relationships between resources and leveraging data source lookups to incorporate external context into policy enforcement workflows. Additionally, it also addresses supply-chain risks by enabling control over provider and module downloads, helping organizations "establish approved dependency controls, and prevent accidental use of unapproved providers or modules".
Another benefite of tfpolicy's deep integration with Terraform is the ability to evaluate policies after deployment, allowing organizations to detect violations that may only become visible once resources have been provisioned.
Terraform will continue to support Sentinel, but HashiCorp is positioning tfpolicy as its preferred policy framework. The company is also introducing an AI agent capable of generating and testing tfpolicy configurations, as well as converting existing Sentinel policies.
As a final note, tfpolicy delivers its full capabilities only within HCP Terraform, where it can be tightly integrated into end-to-end infrastructure workflows, including policy enforcement during planning, deployment, and post-deployment evaluation. In contrast, the standalone CLI is more limited in scope, primarily supporting policy validation and local testing. While useful for development and iteration, it does not provide the same level of integration, automation, or enforcement available in the managed HCP Terraform environment.
HashiCorp Sentinel is an embedded policy-as-code framework that integrates natively with HCP Terraform and allows to write fine-grained, testable rules using Sentinel's custom domain-specific language. Open Policy Agent is an open-source, cloud-native, and vendor-agnostic solution supporting over 100 integrations.