HashiCorp Introduces tfpolicy, an HCL-based Policy-as-Code Framework for Terraform

New Policy Framework for Terraform

HashiCorp has introduced tfpolicy, a new policy-as-code framework for Terraform. This framework is now available in public beta within HCP Terraform. It is designed to modernize infrastructure governance by embedding policy creation and enforcement directly into existing Terraform workflows.

HCL-based and Integrated

tfpolicy is a declarative, HCL-based framework, allowing platform teams to define and enforce policies using the same language used for Terraform infrastructure. This deep integration reduces the need for separate tools and languages, enabling teams to manage policies within their familiar Terraform environment. Policy evaluation occurs both before and after deployment, allowing enforcement based on actual infrastructure state.

Addressing Modern Infrastructure Complexity

HashiCorp states that existing policy solutions often lack external context, such as resource relationships, which can change during the infrastructure lifecycle. tfpolicy addresses this by evaluating policies based on relationships between resources and incorporating external context through data source lookups. This approach is intended for modern infrastructure that spans multiple clouds and services.

Supply Chain Risk Mitigation

The new framework also includes capabilities to address supply-chain risks. It enables control over provider and module downloads, helping organizations establish approved dependency controls. This feature aims to prevent the accidental use of unapproved providers or modules, enhancing security within the infrastructure supply chain.