The Hashicorp stack already supported this kind of usecase, it's called Sentinel: https://www.hashicorp.com/sentinel

I do agree that it's a pity that Sentinel isn't free.

Not only it's not free, but it closed-source, too. When others (such as Scalr, Env0, SpaceLift) are using OPA, HashiCorp uses something that's not portable and that's not even using HCL. Their offering ignored not-invented-there tools such as tfsec, tflint, etc. - they only integrated recently with partners, who possibly do revenue sharing with them. Meanwhile, competitors of TFC are not sleeping and innovating way faster (Env0, for example, supports Terragrunt, which fixes many of the core Terraform issues they've been neglecting for years, such as the lack of dynamic providers). The problem is that HashiCorp is dysfunctional for the past two years. Their focus shifted to who knows what, but many providers are barely maintained (such as TLS). They have over 166 engineering jobs openings on their website - you can tell they are struggling! I guess their engineers are too busy interviewing candidates, but I assume their pay rates are below market as the positions keep staying open for months or there's a steady turnover. They jumped on the cdktf bandwagon to compete with Pulumi, but I'm not sure if that's a practical use of their resources especially when it's not even supported by their commercial offering.

I never understood this sentiment. Hashicorp offers Sentinel for free [1], publicly. The documentation is also open [2]. There's also open rulesets for CIS benchmarks [3] (minimal but demonstrates what Sentinel can do), and a ton of public drop-in rules for several clouds [4]. There's helpers [5,6] for common use cases, supports custom integrations [7] and it can be run in CI [8].

[1]: https://docs.hashicorp.com/sentinel/downloads [2]: https://docs.hashicorp.com/sentinel/intro/getting-started/ru... [3]: https://github.com/hashicorp/terraform-foundational-policies... [4]: https://github.com/hashicorp/terraform-guides/tree/master/go... [5]: https://github.com/hashicorp/terraform-guides/tree/master/go... [6]: https://github.com/hashicorp/terraform-guides/tree/master/go... [7]: https://github.com/hashicorp/sentinel-sdk [8]: https://docs.hashicorp.com/sentinel/commands/apply

I am not sure when they made it free to use (and not sure under what terms exactly), it's part of their most expensive TFC offering and always has been, but why do they believe that people are interested in a closed-source project, that's pretty much not used anywhere else, unlike OPA? I am a TFC commercial user and I'm not interested in using Sentinel as if I decide to switch to Scalr, all that work would be lost of the license doesn't allow me to use it, and if the competitor platforms don't support it due to the licensing constraints.

It looks like it dropped a few months after TFC[1] with a bunch of additional features. At least these days, Teams supports Sentinel, and in personal use cases, I've had TFC be backend and threw a git pre-commit hook at it for Sentinel on my machine. My guess is that for some time, they wanted to focus on enterprise sales and Sentinel was an easy way to upsell. SSO still makes Business worth it though.

[1]: https://www.hashicorp.com/blog/announcing-hashicorp-sentinel...

Yah... this kind of feature would be killer for Terraform...

I can't tell if this should have a /s on it but terraform does have this feature (local-exec, remote-exec) and you don't need Terraform Enterprise, the free one does just fine.

You can also write your own providers etc etc. The whole reason hooks are needed is because you don't have direct access to the execution engine.

If you really want access to the execution engine, looks like one team found a way. https://orca.security/resources/blog/aws-cloudformation-vuln...