A team writes Sentinel policies that need to examine the attribute values Terraform intends to set, so non-compliant changes are stopped before anything is modified. At what point in an HCP Terraform run does policy evaluation occur?
Select an answer to reveal the explanation.
Short Explanation
Picture an inspector who checks the blueprint after it's drawn but before anyone pours concrete. That's where your policy sits in a run: the plan exists, so there's something concrete to judge, and nothing has been changed yet.
Full Explanation
An HCP Terraform run moves through pending, plan, cost estimation, policy check and apply stages. Policy evaluation happens once a plan exists, which lets policies inspect planned changes and values through the tfplan data, together with configuration and current state data, and it happens before apply, so a failing mandatory policy stops the run before any infrastructure changes. For OPA, the policy stage runs after the plan and before cost estimation; Sentinel policy checks can use cost estimation data. Evaluating only raw configuration before planning would leave policies blind to computed and planned values, and while Sentinel can read configuration data, it does so as part of the post-plan evaluation rather than a separate pre-plan gate. Evaluating after apply would turn policy into after-the-fact reporting, because the non-compliant change would already exist. Initialization installs providers and modules and configures the backend; no policy logic runs then. Exam caveat: run tasks are what offer pre-plan, post-plan, pre-apply and post-apply stages; policy sets have a fixed position after plan. Operational check: open a run in a workspace with a policy set attached, expand the timeline, and confirm the policy stage appears between plan (and cost estimation) and the confirm-and-apply step.