Use Terraform outside the core workflow →mediumMultiple ChoiceObjective-mapped

TF-004 Use Terraform outside the core workflow Practice Question

A team is using Terraform Cloud and wants to enforce that all AWS resources created by Terraform have a specific tag. Which feature should they use?

⚠ Common exam trap

Candidates often confuse Sentinel policies (native policy-as-code in Terraform Cloud) with run tasks (which integrate external tools). Sentinel is the correct choice for enforcing mandatory tags directly within Terraform Cloud's workflow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sentinel policies

Sentinel policies are Terraform Cloud's policy-as-code framework that allows teams to enforce mandatory rules on infrastructure configurations before they are applied. By writing a Sentinel policy that checks for the presence and value of a specific tag on all AWS resources, the team can reject any run that does not comply, ensuring consistent tagging across all resources created by Terraform.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Cost estimation
Why it's wrong here
Estimates cost of planned changes, does not enforce tags.
✓
Sentinel policies
Why this is correct
Sentinel enforces policies on configurations before apply.
✗
Workspace variables
Why it's wrong here
Used to set variables per workspace, not to enforce rules.
✗
Run tasks
Why it's wrong here
Integrates third-party tools into runs, not for policy enforcement.

Go deeper

TF-004 Use Terraform outside the core workflow Practice Question

Why each option matters

Option-by-option breakdown

Related to this question