Policy, Registry, and Governance

Scenario: Every team writes its own network module and applies inconsistent encryption, tags, and cost controls.

HCP Terraform surveys at Associate level include private module registry, teams and permissions, policy enforcement, run tasks, variable sets, health/drift visibility, and audit-oriented run history. Sentinel or OPA policies can evaluate plans and enforce guardrails. Policies should explain remediation and distinguish advisory from mandatory controls. A private registry distributes versioned, documented building blocks.

Analogy: Platform governance is a paved road with guardrails: teams move faster because safe defaults and warnings are built into the route.

A worked configuration

# Policy intent expressed conceptually:
# - deny public ingress on administrative ports
# - require owner and cost-center tags
# - cap unapproved instance classes

Measure policy false positives and provide exception workflows. A rule that teams routinely bypass is theater. Combine policy-as-code with module design, provider permissions, and cloud-native controls.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-lifecycle-safety Terraform lab. Open /labs/terraform and choose slug tf-lifecycle-safety; the lab runs real Terraform against the offline FakeCloud provider.