A platform team runs HCP Terraform for 40 workspaces across five projects. Security requires that encryption rules apply to every workspace, including ones created next year, while a cost-center tagging rule must apply only to workspaces in the analytics project. How should the team organize its policies?
Select an answer to reveal the explanation.
Short Explanation
Think of policy sets like house rules versus room rules: the global set covers every room, even ones you build later, and a project-scoped set covers just the one room that needs it. Don't fall for the advisory trick: an advisory rule still runs everywhere and clutters every other team's results.
Full Explanation
HCP Terraform policy sets can be applied globally, to specific projects, to specific workspaces, or to workspaces with particular tags, and a workspace can be governed by several policy sets at once. Applying the encryption set globally means every current and future workspace in the organization inherits it with no per-workspace wiring, while scoping the tagging set to the analytics project limits that rule to exactly the workspaces the requirement names. Placing both rules in one global set and downgrading tagging to advisory still evaluates the tagging rule everywhere; it merely stops it from blocking, so other projects receive irrelevant failures. Scoping one combined set to analytics leaves the rest of the organization without enforced encryption, and check blocks only produce warnings, so they cannot stand in for an enforced policy. Variable sets distribute variable values to workspaces; they supply inputs and have no ability to evaluate or reject a plan. Exam caveat: global scope is a property of the policy set, not of an individual policy, so mixed-scope requirements imply separate sets. Operational check: open the policy set settings, confirm the encryption set shows a global scope and the tagging set lists only the analytics project, then queue a plan in a non-analytics workspace and verify only the encryption policies appear in its results.