Skip to content

Remove policy check deprecation messages from HCPTF and last two TFE versions #469

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
Jun 10, 2025
Merged
Original file line number Diff line number Diff line change
Expand Up @@ -308,7 +308,7 @@ This endpoint uploads code to an existing Sentinel or OPA policy.

This PUT endpoint requires the text of a valid Sentinel or OPA policy with a `Content-Type` of `application/octet-stream`.

- Refer to [Defining Sentinel Policies](/terraform/cloud-docs/policy-enforcement/sentinel) for details about writing Sentinel code.
- Refer to [Defining Sentinel Policies](/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel) for details about writing Sentinel code.
- Refer to [Defining OPA Policies](/terraform/cloud-docs/policy-enforcement/opa) for details about writing OPA code.

### Sample Payload
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ description: >-
Policy checks are the default workflow for Sentinel. Policy checks use the latest version of the Sentinel runtime and have access to cost estimation data.
This set of APIs provides endpoints to get, list, and override policy checks.

~> **Warning:** Policy checks are deprecated and will be permanently removed in August 2025. We recommend that you start using policy evaluations to avoid disruptions.
@include 'deprecation/policy-checks.mdx'

## List Policy Checks

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ description: >-

# Manage policies and policy sets in HCP Terraform

Policies are rules that HCP Terraform enforces on Terraform runs. You can define policies using either the [Sentinel](/terraform/cloud-docs/policy-enforcement/sentinel) or [Open Policy Agent (OPA)](/terraform/cloud-docs/policy-enforcement/opa) policy-as-code frameworks.
Policies are rules that HCP Terraform enforces on Terraform runs. You can define policies using either the [Sentinel](/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel) or [Open Policy Agent (OPA)](/terraform/cloud-docs/policy-enforcement/opa) policy-as-code frameworks.

<!-- BEGIN: TFC:only name:pnp-callout -->

Expand All @@ -28,11 +28,11 @@ Policy checks and evaluations can access different types of data and enable slig

Only Sentinel policies can run as policy checks. Checks can access cost estimation data but can only use the latest version of Sentinel.

~> **Warning:** Policy checks are deprecated and will be permanently removed in August 2025. We recommend that you start using policy evaluations to avoid disruptions.
@include 'deprecation/policy-checks.mdx'

### Policy evaluations

OPA policy sets can only run as policy evaluations, and you can enable policy evaluations for Sentinel policy sets by selecting the `Agent` policy set type.
OPA policy sets can only run as policy evaluations, and you can enable policy evaluations for Sentinel policy sets by selecting the `Agent` policy set type.

HCP Terraform runs a workspace's policy evaluation in your self-managed agent pool if you meet the following requirements:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ _Leaving this stage:_
- If the plan succeeded with no changes and neither cost estimation nor Sentinel policy checks will be done, HCP Terraform considers the run complete (**Planned and Finished** state).
- If the plan succeeded and requires changes:
- If cost estimation is enabled, the run proceeds automatically to the cost estimation stage.
- If cost estimation is disabled and [Sentinel policies](/terraform/enterprise/policy-enforcement/sentinel) are enabled, the run proceeds automatically to the policy check stage.
- If cost estimation is disabled and [Sentinel policies](/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel) are enabled, the run proceeds automatically to the policy check stage.
- If there are no Sentinel policies and the plan can be auto-applied, the run proceeds automatically to the apply stage. Plans can be auto-applied if the auto-apply setting is enabled on the workspace and the plan was queued by a new VCS commit or by a user with permission to apply runs. ([More about permissions.](/terraform/cloud-docs/users-teams-organizations/permissions))
- If there are no Sentinel policies and HCP Terraform cannot auto-apply the plan, the run pauses in the **Needs Confirmation** state until a user with permission to apply runs takes action. ([More about permissions.](/terraform/cloud-docs/users-teams-organizations/permissions)) If an authorized user approves the apply, the run proceeds to the apply stage. If an authorized user rejects the apply, the run does not continue (**Discarded** state).

Expand Down Expand Up @@ -133,7 +133,7 @@ _Leaving this stage:_

## The Sentinel Policy Check Stage

This stage only occurs if [Sentinel policies](/terraform/cloud-docs/policy-enforcement/sentinel) are enabled. After a successful `terraform plan`, HCP Terraform checks whether the plan obeys policy to determine whether it can be applied.
This stage only occurs if [Sentinel policies](/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel) are enabled. After a successful `terraform plan`, HCP Terraform checks whether the plan obeys policy to determine whether it can be applied.

_States in this stage:_

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ This topic provides overview information about how to create and manage organiza

## Requirements

The **admin** permission preset must be enabled on your profile to create and manage organizations in the HCP Terraform UI. Refer to [Permissions](/terraform/cloud-docs/users-teams-organizations/permissions#organization-permissions) for additional information.
The **admin** permission preset must be enabled on your profile to create and manage organizations in the HCP Terraform UI. Refer to [Permissions](/terraform/cloud-docs/users-teams-organizations/permissions#organization-permissions) for additional information.

## API and Terraform Enterprise Provider

Expand All @@ -41,7 +41,7 @@ To join an organization, the organization [owners][] or a user with specific [te
## Leave an organization

1. Sign in to [HCP Terraform](https://app.terraform.io/) or Terraform Enterprise and click the Terraform logo in the page header to navigate to the **Organizations** page.
1. Open the **...** ellipses menu next to the organization and select **Leave organization**.
1. Open the **...** ellipses menu next to the organization and select **Leave organization**.

You do not need permission from the owners to leave an organization, but you cannot leave if you are the last member of the owners team. Either add a new owner and then leave, or [delete the organization](/terraform/cloud-docs/users-teams-organizations/organizations#general).

Expand Down Expand Up @@ -78,7 +78,7 @@ You can view your organization's managed resource count on the **Usage** page.

~> **Reserved tag keys are in beta**: We do not recommend using beta features in production environments.

You can define reserved tag keys that appear as suggested labels when managers want to add tags to their projects and workspaces in the organization. Refer to [Create and manage reserved tag keys](/terraform/cloud-docs/users-teams-organizations/organizations/manage-reserved-tags) for instructions.
You can define reserved tag keys that appear as suggested labels when managers want to add tags to their projects and workspaces in the organization. Refer to [Create and manage reserved tag keys](/terraform/cloud-docs/users-teams-organizations/organizations/manage-reserved-tags) for instructions.

You can also view single-value tags that may already be attached to projects and workspaces. Refer to [Tags](#tags) in the organization settings reference for additional information.

Expand Down Expand Up @@ -130,17 +130,17 @@ Click the **Tags** tab in the **Tags Management** screen to view single-value ta

The only action you can perform in the UI is deleting single-value tags from the system. You can use the following methods to delete single-value tags:

1. Select one or more tags and click **Delete tags**.
1. Select the **Name** header to select all tags, then click **Delete tags**.
1. Click the trash icon for a tag and confirm that you want to permanently delete it when prompted.
1. Select one or more tags and click **Delete tags**.
1. Select the **Name** header to select all tags, then click **Delete tags**.
1. Click the trash icon for a tag and confirm that you want to permanently delete it when prompted.

#### Teams

<!-- BEGIN: TFC:only name:pnp-callout -->
@include 'tfc-package-callouts/team-management.mdx'
<!-- END: TFC:only name:pnp-callout -->

All users in an organization can access the **Teams** page, which displays a list of [teams][] within the organization.
All users in an organization can access the **Teams** page, which displays a list of [teams][] within the organization.

Organization owners and users with the [include secret teams permission](/terraform/cloud-docs/users-teams-organizations/permissions#include-secret-teams) can:
* view all [secret teams](/terraform/cloud-docs/users-teams-organizations/teams/manage#team-visibility)
Expand Down Expand Up @@ -196,14 +196,14 @@ From the Workspaces page, click **Settings** in the sidebar, then **Runs** to vi
- A button allowing you to cancel that run

You can apply the following filters to limit the runs HCP Terraform displays:
- Click **Needs Attention** to display runs that require user input to continue, such as approving a plan or overriding a policy.
- Click **Needs Attention** to display runs that require user input to continue, such as approving a plan or overriding a policy.
- Click **Running** to display runs that are in progress.
- Click **On Hold** to display paused runs.


For precise filtering, click **More filters** and check the boxes to filter runs by specific [run statuses](/terraform/cloud-docs/run/states), [run operations](/terraform/cloud-docs/run/modes-and-options), workspaces, or [agent pools](/terraform/cloud-docs/agents/agent-pools). Click **Apply filters** to list the runs that match your criteria.

You can dismiss any of your filtering criteria by clicking the **X** next to the filter name above the table displaying your runs.
You can dismiss any of your filtering criteria by clicking the **X** next to the filter name above the table displaying your runs.

For more details about run states, refer to [Run States and Stages](/terraform/cloud-docs/run/states).

Expand All @@ -219,7 +219,7 @@ Enable and disable the [cost estimation](/terraform/cloud-docs/cost-estimation)
@include 'tfc-package-callouts/policies.mdx'
<!-- END: TFC:only name:pnp-callout -->

Policies let you define and enforce rules for Terraform runs. You can write them using either the [Sentinel](/terraform/cloud-docs/policy-enforcement/sentinel) or [Open Policy Agent (OPA)](/terraform/cloud-docs/policy-enforcement/opa) policy-as-code frameworks and then group them into policy sets that you can apply to workspaces in your organization. To create policies and policy sets, you must have [permission to manage policies](/terraform/cloud-docs/users-teams-organizations/permissions#organization-permissions).
Policies let you define and enforce rules for Terraform runs. You can write them using either the [Sentinel](/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel) or [Open Policy Agent (OPA)](/terraform/cloud-docs/policy-enforcement/opa) policy-as-code frameworks and then group them into policy sets that you can apply to workspaces in your organization. To create policies and policy sets, you must have [permission to manage policies](/terraform/cloud-docs/users-teams-organizations/permissions#organization-permissions).

#### Policy Sets

Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
<Warning>

Policy checks support Sentinel versions up to 0.40.x, and do not support newer Sentinel versions. We recommend using [policy evaluations](/terraform/cloud-docs/policy-enforcement/manage-policy-sets#policy-evaluations) to avoid disruptions.

</Warning>
23 changes: 14 additions & 9 deletions content/terraform-docs-common/redirects.jsonc
Original file line number Diff line number Diff line change
Expand Up @@ -245,43 +245,48 @@
// Policy enforcement changes related to pre-written Sentinel policies
{
"source": "/terraform/cloud-docs/policy-enforcement/sentinel",
"destination": "/terraform/cloud-docs/policy-enforcement/define-policies/sentinel",
"destination": "/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This redirect URL needed to be fixed, the URL is actually /terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel

"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/define-policies/sentinel",
"destination": "/terraform/cloud-docs/policy-enforcement/define-policies/custom-sentinel",
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/opa",
"destination": "/terraform/cloud-docs/policy-enforcement/define-policies/opa",
"permanent": true
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/sentinel/vcs",
"destination": "/terraform/cloud-docs/policy-enforcement/manage-policy-sets/sentinel-vcs",
"permanent": true
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/opa/vcs",
"destination": "/terraform/cloud-docs/policy-enforcement/manage-policy-sets/opa-vcs",
"permanent": true
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/policy-results",
"destination": "/terraform/cloud-docs/policy-enforcement/view-results",
"permanent": true
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/sentinel/json",
"destination": "/terraform/cloud-docs/policy-enforcement/view-results/json",
"permanent": true
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/sentinel/mock",
"destination": "/terraform/cloud-docs/policy-enforcement/test-sentinel",
"permanent": true
"permanent": true
},
{
"source": "/terraform/cloud-docs/policy-enforcement/sentinel/import/:slug",
"destination": "/terraform/cloud-docs/policy-enforcement/import-reference/:slug",
"permanent": true
"permanent": true
},
// Relocate pre-written Sentinel policies topic
{
Expand Down Expand Up @@ -311,4 +316,4 @@
"destination": "/terraform/docs/tools",
"permanent": true
},
]
]
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ source: terraform-docs-common
Policy checks are the default workflow for Sentinel. Policy checks use the latest version of the Sentinel runtime and have access to cost estimation data.
This set of APIs provides endpoints to get, list, and override policy checks.

~> **Warning:** Policy checks are deprecated and will be permanently removed in August 2025. We recommend that you start using policy evaluations to avoid disruptions.
@include 'deprecation/policy-checks.mdx'

## List Policy Checks

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ source: terraform-docs-common

# Manage policies and policy sets in HCP Terraform

Policies are rules that HCP Terraform enforces on Terraform runs. You can define policies using either the [Sentinel](/terraform/enterprise/policy-enforcement/sentinel) or [Open Policy Agent (OPA)](/terraform/enterprise/policy-enforcement/opa) policy-as-code frameworks.
Policies are rules that HCP Terraform enforces on Terraform runs. You can define policies using either the [Sentinel](/terraform/enterprise/policy-enforcement/define-policies/custom-sentinel) or [Open Policy Agent (OPA)](/terraform/enterprise/policy-enforcement/opa) policy-as-code frameworks.

<!-- BEGIN: TFC:only name:pnp-callout -->

Expand All @@ -30,7 +30,7 @@ Policy checks and evaluations can access different types of data and enable slig

Only Sentinel policies can run as policy checks. Checks can access cost estimation data but can only use the latest version of Sentinel.

~> **Warning:** Policy checks are deprecated and will be permanently removed in August 2025. We recommend that you start using policy evaluations to avoid disruptions.
@include 'deprecation/policy-checks.mdx'

### Policy evaluations

Expand Down Expand Up @@ -127,7 +127,7 @@ To view and manage policy sets, go to the **Policy Sets** section of your organi
The way you set up and configure a new policy set depends on your workflow and where you store policies.

- For [managed policies](#managed-policies), you use the UI to create a policy set and add managed policies.
- For policy sets in a version control system, you use the UI to create a policy set connected to that repository. HCP Terraform automatically refreshes the policy set when you change relevant files in that repository. Version control policy sets have specific organization and formatting requirements. Refer to [Sentinel VCS Repositories](/terraform/enterprise/policy-enforcement/sentinel/vcs) and [OPA VCS Repositories](/terraform/enterprise/policy-enforcement/opa/vcs) for details.
- For policy sets in a version control system, you use the UI to create a policy set connected to that repository. HCP Terraform automatically refreshes the policy set when you change relevant files in that repository. Version control policy sets have specific organization and formatting requirements. Refer to [Sentinel VCS Repositories](/terraform/enterprise/policy-enforcement/manage-policy-sets/sentinel-vcs) and [OPA VCS Repositories](/terraform/enterprise/policy-enforcement/opa/vcs) for details.
- For automated workflows like continuous deployment, you can use the UI to create an empty policy set and then use the [Policy Sets API](/terraform/enterprise/api-docs/policy-sets) to add policies. You can also use the API or the [`tfe` provider (Sentinel Only)](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/policy_set) to add an entire, packaged policy set.

### Create policy sets
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
<Warning>

Policy checks support Sentinel versions up to 0.40.x, and do not support newer Sentinel versions. We recommend using [policy evaluations](/terraform/enterprise/policy-enforcement/manage-policy-sets#policy-evaluations) to avoid disruptions.

</Warning>
21 changes: 13 additions & 8 deletions content/terraform-enterprise/v202504-1/redirects.jsonc
Original file line number Diff line number Diff line change
Expand Up @@ -737,43 +737,48 @@
// Policy enforcement changes related to pre-written Sentinel policies
{
"source": "/terraform/enterprise/policy-enforcement/sentinel",
"destination": "/terraform/enterprise/policy-enforcement/define-policies/sentinel",
"destination": "/terraform/enterprise/policy-enforcement/define-policies/custom-sentinel",
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/define-policies/sentinel",
"destination": "/terraform/enterprise/policy-enforcement/define-policies/custom-sentinel",
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/opa",
"destination": "/terraform/enterprise/policy-enforcement/define-policies/opa",
"permanent": true
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/sentinel/vcs",
"destination": "/terraform/enterprise/policy-enforcement/manage-policy-sets/sentinel-vcs",
"permanent": true
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/opa/vcs",
"destination": "/terraform/enterprise/policy-enforcement/manage-policy-sets/opa-vcs",
"permanent": true
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/policy-results",
"destination": "/terraform/enterprise/policy-enforcement/view-results",
"permanent": true
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/sentinel/json",
"destination": "/terraform/enterprise/policy-enforcement/view-results/json",
"permanent": true
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/sentinel/mock",
"destination": "/terraform/enterprise/policy-enforcement/test-sentinel",
"permanent": true
"permanent": true
},
{
"source": "/terraform/enterprise/policy-enforcement/sentinel/import/:slug",
"destination": "/terraform/enterprise/policy-enforcement/import-reference/:slug",
"permanent": true
"permanent": true
},
// Relocate pre-written Sentinel policies topic
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ source: terraform-docs-common
Policy checks are the default workflow for Sentinel. Policy checks use the latest version of the Sentinel runtime and have access to cost estimation data.
This set of APIs provides endpoints to get, list, and override policy checks.

~> **Warning:** Policy checks are deprecated and will be permanently removed in August 2025. We recommend that you start using policy evaluations to avoid disruptions.
@include 'deprecation/policy-checks.mdx'

## List Policy Checks

Expand Down
Loading
Loading