hashicorp/terraform-policy-agent repository overview

The Terraform Policy Agent converts existing Sentinel and OPA (Rego) policies into Terraform policies. For each source policy, it generates the corresponding policy file and tests, executes the tests, and produces a report for review before the converted policies are enforced.

What it does

• Reads existing policies: Accepts Sentinel (.sentinel) and OPA (.rego) policies as individual files, lists of files, or entire policy repositories.
• Generates and validates Terraform policies: Creates a Terraform policy file (.policy.hcl) and corresponding tests (.policytest.hcl) for each source policy, validates them against Terraform provider schemas, and runs tfpolicy validate and tfpolicy test.
• Produces conversion reports: Generates a report for each policy and a consolidated summary covering all policies, including those that could not be converted successfully.
• Supports multiple model providers: Runs in a container and supports model access through GitHub Copilot, Amazon Bedrock, or LiteLLM.

Getting started

This image is launched using the run scripts provided in the GitHub repository. Refer to the repository README⁠ for setup and execution instructions.

Prerequisites

• Docker or Podman.
• Linux terraform and tfpolicy binaries (version 0.3.0 or later), obtained from https://releases.hashicorp.com⁠ and compatible with your machine's architecture.
• A running Terraform MCP server: https://hub.docker.com/r/hashicorp/terraform-mcp-server⁠
• Access to a supported model provider through GitHub Copilot, Amazon Bedrock, or LiteLLM.

Review before use

The generated output is produced by a language model and may require further review. Carefully review each converted policy and run its tests before enforcing it. Begin by using the policies in advisory mode to assess their behavior before enabling enforcement.

Documentation and support

For setup instructions, the quick start guide, and additional documentation, refer to the repository README⁠