Policy/Rule Enforcement

[matt-gp]

Are there any plans for some sort of policy enforcement?

I know enterprise users would like to have the peace of mine knowing that they can enforce rules centrally to ensure users are not doing things that they shouldn't be and that restrictions can be enforced where needed.

[ghost]

Hey @matt-gp what kind of rules are you thinking about? Could you list a few specific examples?

[matt-gp]

Things like making sure that S3 buckets aren't public or that ALB's aren't allowing traffic from 0.0.0.0.

I think having the ability to create custom rules, similar to Terraform Sentinel, and then ensure that users conform to them.

[ghost]

That is a big ask since all providers would need to support it. Big cloud providers already have tools to enforce these kinds of policies, which is probably a better way to handle this since anyone able to run OpenTofu would be able to override the enforcement, whereas the cloud-based enforcement cannot be overridden in the same way.

[Yantrio]

There is a discussion around a similar feature here: #370
Whilst the issue is closed, feedback is still welcome and we're always happy to re-open issues if we feel there's a good community drive to do so :D