Add Terraform Cloud (Sentinel)

Verify prerequisites.
For Terraform Cloud (Sentinel) integration with Prisma Cloud Application Security, you need access and information to Terraform environments.
Terraform Cloud Console.
Access to Terraform Cloud console enables you to gather information on Workspace ID, Workspace Name, Workspace Description, User or Team token and Sentinel Parameters all required to help integrate a workspace with the Prisma Cloud console.
The Terraform Cloud (Sentinel) User token or Team token authorizes Prisma Cloud to access to your workspaces and helps create sentinel configuration file and policy file.
The user or team must either have the
Manage Workspaces
permission at the organization level or admin permission on the workspace(s) being integrated.
To create Terraform Cloud (Sentinel) policy sets from your version control system as code, you need two files to ensure a Terraform policy set runs for Prisma Cloud:
Sentinel configuration file (sentinel.hcl)
A Sentinel configuration file contains the policy name, the enforcement level of the policy, and the source path of the policy. You are required to define the actual path for a policy source in the Sentinel configuration file.
Policy file (policyname.sentinel)
- Policy file (policyname.sentinel) are individual policy files that are created in the same path as the Sentinel configuration file. The name of the policy file must be the same as the policy name in the configuration file with a .sentinel.
Integrate and configure Terraform Cloud (Sentinel) with Prisma Cloud.
Select

Settings > Repositories > Add Repository

.

Select

Terraform Cloud (Sentinel)

.



Add

Workspace

Id

,

Workspace Name

,

Workspace Description

and

Terraform User or Team Token

.

If you do not have the specific information access

Terraform Cloud console > Workspace > Settings > General

to view and copy the required information.



Select

Next

.


Create Sentinel files within your version control system.
You need two Sentinel files — sentinel.hcl, which defines the relevant policies, and prismacloud.sentinel, which contains the actual policy logic - to ensure Terraform policy set runs with Prisma Cloud configurations.
Create a sentinel.hcl file in your VCS (version control system).

Copy and then paste the code from Prisma Cloud console in the new sentinel.hcl file.

The code helps you define your policy and the enforcement level for the policy within Terraform Enterprise. Sentinel supports three enforcement_level and you can choose one.

hard-mandatory: Fix or Suppress failing policies with this enforcement level to apply Terraform runs.

soft-mandatory: Fix or Suppress failing policies with this enforcement level to apply Terraform runs. However, you can override the policy failure for IaC violations.

advisory : Policy failure with this enforcement level does not stop Terraform runs. However you will see reports and record policy violations.



Optionally, you can edit the default source path ./prismacloud.sentinel to the location of another sentinel file in the code and the select

Next

. It is recommend to use the default value.

Create a prismacloud.sentinel file in your VCS (version control system).

Copy and then paste the code from Prisma Cloud console in the new prismacloud.sentinel file (or another file if you are not using the default value), and then select

Next

.


Connect Policy Set on Terraform Cloud console.
Access Terraform Cloud console and then select
Settings > Policy sets > Connect a new policy set
.

Select the version control system, the repository, branch and the repository path where you created the files.
Add
Name
and
Description
of the policy.

Select
Scope of Policies
.
Policies enforced on selected workspaces
is the default selection.

Select
Connect policy set
.

Select
Settings > Policy Set > Sentinel Parameters
and select
Add parameter
.
Add
api_key
and then select
Sensitive
.
Access
Workspaces > Workspace > Actions > Start new plan
to validate the new policy set against the workspace.

Access
Application Security > Projects
to view the latest integrated Terraform Cloud (Sentinel) repository to Suppress or Fix the policy misconfigurations.