Terraform Policy
by hashicorpf706481af9b8MPL-2.0890 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 3 days ago
Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.
Only the file list is public. File contents are available once the skill is installed in a workspace.
| Path | Size | Type |
|---|---|---|
| examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl | 589 B | text/plain |
| examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel | 1.6 KB | text/plain |
| examples/conversion/cloudfront-associated-with-waf/README.md | 871 B | text/markdown |
| examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl | 512 B | text/plain |
| examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel | 1.4 KB | text/plain |
| examples/conversion/cloudtrail-server-side-encryption-enabled/README.md | 846 B | text/markdown |
| examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl | 516 B | text/plain |
| examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel | 1.5 KB | text/plain |
| examples/conversion/dms-endpoint-should-be-ssl-configured/README.md | 872 B | text/markdown |
| examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl | 579 B | text/plain |
| examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel | 1.4 KB | text/plain |
| examples/conversion/dms-endpoints-should-use-ssl/README.md | 800 B | text/markdown |
| examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.policy.hcl | 1 KB | text/plain |
| examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.sentinel | 2.9 KB | text/plain |
| examples/conversion/ec2-network-acl-should-have-subnet-ids/README.md | 970 B | text/markdown |
| examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.policy.hcl | 865 B | text/plain |
| examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.sentinel | 3.6 KB | text/plain |
| examples/conversion/ec2-vpc-default-security-group-no-traffic/README.md | 1.1 KB | text/markdown |
| examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.policy.hcl | 448 B | text/plain |
| examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.sentinel | 1.3 KB | text/plain |
| examples/conversion/efs-access-point-should-enforce-user-identity/README.md | 727 B | text/markdown |
| examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl | 547 B | text/plain |
| examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel | 1.5 KB | text/plain |
| examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/README.md | 777 B | text/markdown |
| examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl | 584 B | text/plain |
| examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel | 1.5 KB | text/plain |
| examples/conversion/elasticsearch-encrypted-at-rest/README.md | 734 B | text/markdown |
| examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl | 1.1 KB | text/plain |
| examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel | 2.3 KB | text/plain |
| examples/conversion/elasticsearch-https-required/README.md | 904 B | text/markdown |
| examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl | 589 B | text/plain |
| examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel | 1.9 KB | text/plain |
| examples/conversion/elasticsearch-in-vpc-only/README.md | 890 B | text/markdown |
| examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl | 845 B | text/plain |
| examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.sentinel | 2.1 KB | text/plain |
| examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/README.md | 1.1 KB | text/markdown |
| examples/conversion/s3-block-public-access-bucket-level/README.md | 1.1 KB | text/markdown |
| examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.policy.hcl | 1.2 KB | text/plain |
| examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.sentinel | 3.2 KB | text/plain |
| examples/conversion/s3-bucket-should-have-object-lock-enabled/README.md | 975 B | text/markdown |
| examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.policy.hcl | 1 KB | text/plain |
| examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.sentinel | 2.8 KB | text/plain |
| examples/conversion/secretsmanager-auto-rotation-enabled-check/README.md | 955 B | text/markdown |
| examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.policy.hcl | 867 B | text/plain |
| examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.sentinel | 2.2 KB | text/plain |
| examples/conversion/step-functions-state-machine-logging-enabled/README.md | 778 B | text/markdown |
| examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.policy.hcl | 724 B | text/plain |
| examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.sentinel | 1.6 KB | text/plain |
| examples/README.md | 2.5 KB | text/markdown |
| .gitignore | 29 B | text/plain |
| README.md | 2.8 KB | text/markdown |
| references/tfpolicy-author.md | 97.6 KB | text/markdown |
| references/tfpolicy-test.md | 45.1 KB | text/markdown |
| references/verified-syntax.md | 100 KB | text/markdown |
| SKILL.md | 3.9 KB | text/markdown |
Source and attribution
Source:hashicorp/agent-skillsinplugins/terraform/skills/terraform-policyat commitf706481
License: MPL-2.0
Content belongs to its original authors. SourceWeft indexes it from a public repository.
More from hashicorp/agent-skills
Terraform Test
hashicorp
Guides writing and running Terraform tests with .tftest.hcl files, run blocks, assertions, mocks and CI integration.
Terraform Style Guide
hashicorp
Generates and reviews Terraform HCL code following HashiCorp's official style conventions and best practices.
Terraform Stacks
hashicorp
Guides writing and validating HashiCorp Terraform Stacks configuration files for multi-environment infrastructure.
Refactor Module
hashicorp
Guides refactoring monolithic Terraform configurations into reusable, maintainable modules with migration and tests.
Provider Resources
hashicorp
Implement Terraform Provider resources and data sources using the Plugin Framework: CRUD operations, schema design, plan modifiers and validators, not-found handling, waiters for eventually consistent APIs, import support, resource design principles, and required acceptance test coverage. Use when adding or changing a resource or data source, deciding whether an API concept should be a resource, wiring a resource to the provider's configured client, handling drift or resource-not-found, or reviewing a resource implementation before submission.
Provider Framework Migration
hashicorp
Guides migrating Terraform provider resources from Plugin SDKv2 to the Plugin Framework using a muxed provider.
More in Software Development
Playground
anthropics
Builds self-contained interactive HTML playgrounds with controls, live preview, and copyable prompt output.
M5 Onboard
anthropics
Provisions M5Stack ESP32 boards by detecting them on USB, flashing UIFlow 2.0 firmware, and installing a MicroPython app bundle.
Cardputer Buddy
anthropics
Guides iterating on a Cardputer-Adv MicroPython app bundle: adding apps, pushing files over USB-serial, tailing logs, and running REPL commands.
Web Design Guidelines
vercel-labs
Reviews UI code against Web Interface Guidelines fetched from a remote source and reports findings as file:line entries.
Vercel React Native Skills
vercel-labs
React Native and Expo best-practice rules covering list performance, animation, navigation, UI patterns, state, and monorepo setup.
Vercel React Best Practices
vercel-labs
Vercel's React and Next.js performance guidelines, organized as 70 rules for writing, reviewing, and refactoring code.