Terraform Sentinel / OPA Policy Generator

Policy-as-code keeps Terraform guardrails consistent, reviewable and version controlled instead of buried in a wiki page or someone tribal memory. This generator writes a Sentinel or Open Policy Agent (OPA / Rego) policy from a chosen template so you can enforce allowed regions, required tags, public-bucket bans and version constraints without hand-writing the syntax. Sentinel is the HashiCorp policy language used by Terraform Cloud and Enterprise, while OPA Rego is a general-purpose policy language that runs with Conftest, Gatekeeper or the OPA CLI. Both read the same plan data, so the generator maps your intent to the correct rule structure for each language. The output is plain text you save into your policy repository, review in pull requests, and run inside CI or a policy server. Nothing is uploaded and no policy engine is contacted, so you can experiment freely with different rules and parameters before committing them. Whether you are standardising a multi-team platform or adding your very first guardrail, the generator removes the syntax barrier and lets you focus on the rule itself rather than the language details. It pairs well with the security scanner and the sensitive value redactor, forming a small but effective local policy toolkit you can use before every plan.

• Two languages - generate Sentinel (.sentinel) or OPA Rego (.rego) from the same intent, so one rule works in either engine.
• Four templates - restrict regions, require tags, forbid public S3, and require a Terraform version, covering the most common guardrails.
• Parameterised - regions, tag keys and version constraints come straight from your inputs, so there are no hard-coded values.
• Valid syntax - output follows each language rule and import conventions, including the tfplan import for Sentinel.
• Copy-paste ready - drop the result into your policy repository and it is ready to evaluate.
• Validation - required parameters are enforced before generation, so you never get a half-finished policy.
• Stats row - a live panel shows the selected language, template and the resulting line count.
• Word-wrap toggle - switch the preview between scroll and wrap for comfortable reading.
• Sample loader - fill every field with a realistic example in a single click.
• Beginner friendly - sensible defaults mean you can generate a working rule even on your first try.
• Copy / Download / Print - export the policy exactly as shown in the preview.

1. Pick a language - choose Sentinel or OPA (Rego) from the language dropdown.
2. Choose a template - select restrict-regions, require-tags, forbid-public-s3 or require-version.
3. Enter parameters - type the regions, tag keys or version the rule should enforce, matching the template you picked.
4. Load the sample if you want a working OPA region restriction filled in automatically.
5. Click Generate to build the policy text from your inputs.
6. Review the preview and check the stats row for the language, template and size.
7. Toggle word wrap if the lines are long on a small screen.
8. Export by copying, downloading, or printing the policy for your repository.
9. Wire it into CI - run Sentinel or OPA against your plan so the guardrail actually blocks non-compliant changes.

Example - OPA restrict-regions. Selecting OPA with the restrict-regions template and entering us-east-1, eu-west-1 emits a package terraform block with a deny rule that fails any resource whose region is outside the allowed set, plus helper rules per region. The same intent in Sentinel produces an allowed_regions list and a main = rule that iterates tfplan.resources, so both guardrails behave identically when evaluated against a plan. This is the most common policy teams want first, because it stops accidental deployments into the wrong region.

Example - require-tags. Choosing require-tags with Owner, Environment produces a rule that fails any resource missing either tag, which satisfies a typical tagging-compliance requirement without manual audits.

• Consistent guardrails - one source of truth for what infrastructure is allowed across every team.
• Portable - policies run in CI, Terraform Cloud, or an OPA server without modification.
• Fast - no need to memorise Sentinel or Rego syntax before writing your first rule.
• Private - generation happens entirely in the browser with no uploads.
• Reviewable - generated text is plain and easy to diff in pull requests.
• Onboarding - new engineers can produce a correct policy in seconds rather than days.
• Compliance - documented guardrails make audits and reviews straightforward to demonstrate.