How-to run policy checks against aliased providers in Hashicorp Sentinel

Introduction

Expected Outcome

Be able to run existing policy checks against Terraform code containing aliased providers

Use Case

If a given Sentinel policy does not account for aliased providers and a user implements them, it will return "undefined" rather than the intended value (and likely the intended value type) and the policy check will fail.

Procedure

In order to address this, it is necessary to configure your code to utilize tfconfig.providers- this construct allows for iterating over aliased providers to ensure configured policy checks run against them.

Here is a redacted example JSON output from a mockup including AWS provider aliases for "primary" and "replica":

  "aws": {
    "alias": {
      "primary": {
        "config": {
          # aliased provider configuration here for "primary"
      },
      "replica": {
        "config": {
          # aliased provider configuration here for "replica"
      }
    }
  }
}

Additional Information

• Hashicorp Sentinel Reference Policies