The Integrated Alternative
While OPA is open-source and tool-agnostic, HashiCorp provides Sentinel, a policy engine embedded directly into Terraform Cloud and Terraform Enterprise. If your organization already uses Terraform Cloud, Sentinel is available with zero additional infrastructure — no policy server to deploy or maintain.
The Sentinel Language
Sentinel uses its own policy language, also called Sentinel. It is more readable than Rego for engineers unfamiliar with declarative logic — it resembles Python or Go:
import "tfplan/v2" as tfplan
# Get all EC2 instances from the plan
ec2_instances = filter tfplan.resource_changes as _, rc {
rc.type is "aws_instance" and
rc.mode is "managed" and
(rc.change.actions contains "create" or rc.change.actions contains "update")
}
# Define allowed instance types
allowed_types = ["t3.micro", "t3.small", "t3.medium"]
# Rule: All EC2 instances must use an allowed type
instance_type_allowed = rule {
all ec2_instances as _, instance {
instance.change.after.instance_type in allowed_types
}
}
# Main rule — this is what Terraform Cloud evaluates
main = rule {
instance_type_allowed
}
Enforcement Levels
Sentinel's most distinctive feature is its three-tier enforcement model:
| Level | Behavior | Use Case |
|---|---|---|
hard-mandatory |
Failure blocks the run. Cannot be overridden. | Security requirements (no public buckets) |
soft-mandatory |
Failure pauses the run. A privileged user can override with a justification. | Budget thresholds, non-critical compliance |
advisory |
Failure logs a warning but does not block. | Informational checks, gradual rollout of new policies |
The soft-mandatory level is particularly valuable for operational policies. If a deployment would exceed the monthly budget by 15%, you probably don't want to hard-block it — you want a senior engineer to review and approve it. Sentinel's override mechanism provides this workflow natively, with a full audit trail of who approved what and why.
OPA vs. Sentinel: When to Choose Which
| Factor | OPA | Sentinel |
|---|---|---|
| Cost | Free, open-source | Requires Terraform Cloud/Enterprise license |
| Setup | Requires pipeline integration | Built into Terraform Cloud |
| Flexibility | Works with any system (K8s, APIs, etc.) | Terraform-focused |
| Language | Rego (steeper learning curve) | Sentinel (more readable) |
| Enforcement levels | Must implement in pipeline logic | Native hard/soft/advisory |
Choose OPA when you need a single policy engine across multiple systems (Kubernetes, Terraform, internal APIs). Choose Sentinel when your team is already on Terraform Cloud and wants the fastest path to enforcement with the least operational overhead.
Interviewers at companies using Terraform Enterprise often ask: "What's the difference between a hard-mandatory and soft-mandatory Sentinel policy, and when would you use each?" The answer: hard-mandatory is for non-negotiable security controls where no human override is acceptable (e.g., "never expose port 22 to 0.0.0.0/0"). soft-mandatory is for policies where business context might justify an exception — budget overruns, non-standard instance types for a specific project — and you want an approval workflow with an audit trail rather than a hard block.