HashiCorop Sentinelを使って特定のTerraformプロバイダーのみ利用を許可する

# This policy blocks Terraform Apply when a provider not listed in the `allowed_providers` parameter is detected in the configuration.
# NOTE: this policy should not be considered as full mitigation against threats from potentially malicious providers, due to the fact that provider code is executed during the plan phase. This policy is intended to provide a basic level of protection against accidental use of disallowed providers.

import "tfconfig/v2" as tfconfig

param allowed_providers default ["registry.terraform.io/hashicorp/aws"]

violating_providers = filter tfconfig.providers as _, p {
	p.full_name not in allowed_providers
}

if length(violating_providers) > 0 {
	print("These providers are not allowed:")
	for violating_providers as _, p {
		print(" - " + _ + " (" + p.full_name + ")")
	}
}

main = rule {
	length(violating_providers) == 0
}

terraform {
  required_providers {
    tfe = {
      source  = "hashicorp/tfe"
      version = "0.68.2"
    }
  }
  cloud {
    organization = "<HCP Terraform Organization名>"
    workspaces {
      name    = "providers-allowlist-sentinel"
      project = "<HCP Terraform Project名>"
    }
  }
}

provider "tfe" {}

variable "organization_name" {
  type = string
}

variable "project_name" {
  type = string
}

data "tfe_project" "this" {
  name         = var.project_name
  organization = var.organization_name
}

resource "tfe_policy" "this" {
  enforce_mode = "hard-mandatory"
  kind         = "sentinel"
  name         = "providers-allowlist"
  organization = var.organization_name
  policy       = file("${path.module}/files/providers-allowlist.sentinel")
}

# ポリシー動作確認用ワークスペース
resource "tfe_workspace" "this" {
  name         = "providers-allowlist-test"
  organization = var.organization_name
  project_id   = data.tfe_project.this.id
}

resource "tfe_policy_set" "this" {
  name          = "providers-allowlist"
  organization  = var.organization_name
  kind          = "sentinel"
  agent_enabled = "true"
  policy_ids    = [tfe_policy.this.id]
  workspace_ids = [tfe_workspace.this.id]
}

# tfeとawsプロバイダーを許可
resource "tfe_policy_set_parameter" "this" {
  key           = "allowed_providers"
  value         = "[registry.terraform.io/hashicorp/aws, registry.terraform.io/hashicorp/tfe]"
  policy_set_id = tfe_policy_set.this.id
}

organization_name = "<HCP Terraform Organizations名>"
project_name      = "<HCP Terraform Project名>"

terraform init
terraform plan
terraform apply

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.7.0"
    }
    tfe = {
      source  = "hashicorp/tfe"
      version = "0.68.2"
    }
    local = {
      source  = "hashicorp/local"
      version = "2.5.3"
    }
  }
  cloud {
    organization = "<HCP Terraform Organization名>"
    workspaces {
      name    = "providers-allowlist-test"
      project = "<HCP Terraform Project名>"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

resource "aws_vpc" "this" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "providers-allowlist-test"
  }
}

terraform init
terraform plan

→ Policy set 3: providers-allowlist (1)
  ↳ Policy name: providers-allowlist-tf.sentinel
     | × Failed
     | This policy blocks Terraform Apply when a provider not listed in the `allowed_providers` parameter is detected in the configuration.
NOTE: this policy should not be considered as full mitigation against threats from potentially malicious providers, due to the fact that provider code is executed during the plan phase. This policy is intended to provide a basic level of protection against accidental use of disallowed providers.
╷
│ Error: Task Stage failed.

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.7.0"
    }
    tfe = {
      source  = "hashicorp/tfe"
      version = "0.68.2"
    }
-    local = {
-      source  = "hashicorp/local"
-      version = "2.5.3"
-    }
  }
  ...
}

terraform plan

→ Policy set 3: providers-allowlist (1)
  ↳ Policy name: providers-allowlist.sentinel
     | ✓ Passed