How to Enforce Resource Constraints with Sentinel Policies in Terraform Cloud
A company uses Terraform Cloud and wants to enforce policies that all EC2 instances must be of type t2.micro or t2.small. Which feature should they use?
Quick Answer
The answer is Sentinel policies, the policy-as-code framework built into Terraform Cloud and Terraform Enterprise. Sentinel allows organizations to define fine-grained, logic-based rules—such as enforcing that all EC2 instances must be of type t2.micro or t2.small—by writing policies in a dedicated language that are evaluated before any infrastructure is provisioned. On the HashiCorp Terraform Associate TF-003 exam, this question tests your understanding of Terraform Cloud’s governance features, often appearing as a distractor where candidates confuse Sentinel with cost estimation (Option A) or security scanning (Option B). A common trap is assuming a third-party tool handles policy enforcement, but Sentinel is the native solution for resource constraints. Remember the mnemonic: “Sentinel Stands Sentinel over your resources”—it’s the only feature that actively blocks non-compliant runs based on custom rules.
⚠ Common exam trap
A common mistake in Terraform exams is to confuse terraform validate (syntax checks) with Sentinel policy enforcement (business rules). Candidates may mistakenly choose terraform validate because they think validation includes policy checks, but Sentinel is the correct feature for enforcing rules like allowed instance types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sentinel policies
Sentinel policies are HashiCorp's policy-as-code framework integrated with Terraform Cloud. They allow organizations to define fine-grained, logic-based rules that are enforced during the plan phase, such as restricting EC2 instance types to t2.micro or t2.small. This is the correct feature because it provides mandatory, automated policy enforcement across all workspaces, ensuring compliance before any infrastructure is provisioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run tasks
Why it's wrong here
Run tasks integrate external tools but are not policy enforcement built-in.
- ✗
Cost estimation
Why it's wrong here
Cost estimation provides cost forecasts, not policy enforcement.
- ✓
Sentinel policies
Why this is correct
Sentinel is the policy-as-code framework for enforcing rules.
- ✗
Terraform validate
Why it's wrong here
Validate checks syntax, not policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on TF-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Terraform Cloud and wants to ensure that only approved modules from the private registry are used in configurations. How can they enforce this?
hard- A.Restrict module sources in VCS
- B.Configure workspace variables to limit module paths
- ✓ C.Use Sentinel policies to check module sources
- D.Use run tasks to scan for module types
Why C: Sentinel is HashiCorp's policy-as-code framework that can enforce governance rules on Terraform Cloud runs. By writing a Sentinel policy that inspects the `module` block's `source` attribute, you can restrict configurations to only use modules from the approved private registry, rejecting any run that references external or unapproved sources.
Variation 2. A team is using Terraform Cloud and wants to enforce that all AWS resources created by Terraform have a specific tag. Which feature should they use?
medium- A.Cost estimation
- ✓ B.Sentinel policies
- C.Workspace variables
- D.Run tasks
Why B: Sentinel policies are Terraform Cloud's policy-as-code framework that allows teams to enforce mandatory rules on infrastructure configurations before they are applied. By writing a Sentinel policy that checks for the presence and value of a specific tag on all AWS resources, the team can reject any run that does not comply, ensuring consistent tagging across all resources created by Terraform.
Variation 3. Refer to the exhibit. A Terraform Cloud plan includes an EC2 instance of type 't2.medium'. The team uses Sentinel policies. Which action should they take to proceed?
medium- A.Modify the Sentinel policy to allow t2.medium.
- B.Disable the policy check for this run.
- ✓ C.Change the instance type in the configuration to t2.micro or t2.small.
- D.Override the policy in the run using Terraform Cloud UI.
Why C: Sentinel policies enforce compliance rules, and if the policy explicitly denies 't2.medium', the team must modify their configuration to use an allowed instance type (e.g., t2.micro or t2.small) to pass the policy check. This aligns with the principle of infrastructure-as-code where policies are immutable guardrails, and the configuration must be adapted to meet them rather than bypassing the policy.
Variation 4. A team uses Terraform Cloud for remote state management. They want to ensure that state file changes are only made through the Terraform Cloud API and not through direct access to the storage backend. Which feature should they enable?
medium- A.Sentinel policy enforcement
- ✓ B.Remote state locking
- C.VCS integration
- D.Team tokens
Why B: Remote state locking ensures that only one operation can modify the Terraform state at a time. When using Terraform Cloud as the remote backend, locking is automatically managed and prevents any direct modifications to the state file outside of a Terraform run. Because Terraform Cloud handles locking through its API, any attempt to directly access the storage backend would fail to acquire a lock, thus preventing changes. This effectively enforces that all state modifications go through the Terraform Cloud API.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.