An organization decides that any HCP Terraform run deleting resources in production workspaces must stop and receive explicit approval from a designated reviewer group, while runs that only create or update resources proceed normally. Which control meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
You want a gate that only closes for deletions and only opens for the right people. A soft-mandatory policy that fails on delete actions does both: it stops those runs, and only the reviewers holding override rights can let one through.
Full Explanation
Sentinel can inspect the planned resource changes through the tfplan/v2 import, where each change records its actions, and a policy can fail when any action includes delete, which also catches replacements. At soft-mandatory enforcement the failure stops the run, and only users holding the Manage Policy Overrides permission, granted to the reviewer group, can override it, giving the required explicit approval only for runs that delete something. Scoping the policy set to production workspaces keeps other environments unaffected. An advisory policy records the deletion in results but lets the run continue, so no approval is ever required. The prevent_destroy argument makes any plan that destroys the resource fail outright with no approval path, and it disappears if the whole resource block is removed, so it neither allows approved deletions nor covers every case. Disabling auto-apply requires a confirmation on every run, including create-only and update-only runs, and any user with apply permission can confirm, so the reviewer group is not singled out. Exam caveat: hard-mandatory would block deletions entirely unless the policy set allows overrides. Operational check: plan a change that removes a test resource in a production workspace, confirm the run stops at the policy stage, and confirm only a reviewer can override it.