Which Terraform feature allows enforcing security controls before changes are applied?

Which Terraform feature allows enforcing security controls before changes are applied?

• A. Sentinel policy
• B. Variables with defaults
• C. Output blocks
• D. State locking

Answer: (A)

Sentinel policies provide pre-apply governance, letting you codify security requirements as policy rules that must pass before Terraform changes are applied. In Terraform Cloud/Enterprise, you can write Sentinel rules to inspect the planned changes and block any plan that violates security controls—such as requiring encryption, banning public exposure, enforcing tags, or restricting certain resources or attributes. This gates the apply step, so non-compliant changes never reach production. Variables with defaults only supply values for configuration and don’t enforce security constraints before changes. Output blocks are used to expose computed values after apply, not to gate changes. State locking prevents concurrent modifications to the state file, focusing on safety and consistency, not policy enforcement. So, the ability to enforce controls before changes are applied comes from Sentinel policy.

Sentinel policies provide pre-apply governance, letting you codify security requirements as policy rules that must pass before Terraform changes are applied. In Terraform Cloud/Enterprise, you can write Sentinel rules to inspect the planned changes and block any plan that violates security controls—such as requiring encryption, banning public exposure, enforcing tags, or restricting certain resources or attributes. This gates the apply step, so non-compliant changes never reach production.

Variables with defaults only supply values for configuration and don’t enforce security constraints before changes. Output blocks are used to expose computed values after apply, not to gate changes. State locking prevents concurrent modifications to the state file, focusing on safety and consistency, not policy enforcement.

So, the ability to enforce controls before changes are applied comes from Sentinel policy.