A compliance rule says no run may create a public storage bucket, and no user, including organization owners, may override a failure. The team writes its policies in Sentinel. How should enforcement be configured?
Select an answer to reveal the explanation.
Short Explanation
Sentinel gives you three volume knobs: advisory warns, soft-mandatory blocks but can be overridden, and hard-mandatory blocks for real. The catch is that a policy set can be configured to allow overrides even for hard-mandatory, so leave that option off. And don't jump to OPA thinking mandatory means unbreakable; OPA's mandatory can be overridden.
Full Explanation
Sentinel policies in HCP Terraform use three enforcement levels. Advisory failures are reported but never stop a run. Soft-mandatory failures stop the run, but users with override permission, which includes organization owners, can let it continue. Hard-mandatory failures stop the run until the violation is fixed, unless the policy set containing the policy has been configured to allow overrides for mandatory failures; that set-level option takes precedence over the individual policy's level. Meeting a no-override requirement therefore needs hard-mandatory and a policy set without the override option. Soft-mandatory remains overridable by owners even if every other team loses the override permission, so it cannot satisfy the requirement. OPA policies have only advisory and mandatory levels, and OPA mandatory failures can be overridden by users with the Manage Policy Overrides permission, so switching frameworks weakens enforcement. Enabling the set's override option explicitly permits overrides of hard-mandatory failures, the opposite of the rule. Exam caveat: who can change the policy set itself also matters, because an administrator who can edit enforcement levels can bypass any rule. Operational check: queue a plan that creates a public bucket and confirm the run stops with no override option shown, even to an owner.