Setting the file. One moment.
Subchapter 16.37
examples/README.mdMarkdown3 KBView on GitHub
This folder packages representative Sentinel-to-tfpolicy conversion examples for sharing with teammates.
Each example subfolder contains:
<sentinel-policy-name>.sentinel - the actual Sentinel policy file included for comparison<sentinel-policy-name>.policy.hcl - the tfpolicy version or best approximationREADME.md - explanation of the conversion quality, what changed, and any limitationsConverted tfpolicy examples in this bundle prefer remediation-focused diagnostics over repeating Terraform addresses from Sentinel summary {} output. Terraform Policy diagnostics already identify the failing object and point to the relevant location, so converted examples avoid ${meta.address} in error messages.
Included examples:
dms-endpoints-should-use-ssl - direct attribute conversion (Perfect)elasticsearch-https-required - nested block conversion (Good)eventbridge-custom-event-bus-should-have-attached-policy - cross-resource conversion via core::getresources() (Limited)cloudfront-associated-with-waf - approximation only due to missing reference metadata (Not convertible as an exact translation)efs-access-point-should-enforce-user-identity - direct presence check (Perfect)elasticsearch-encrypted-at-rest - nested encryption block check (Good)dms-endpoint-should-be-ssl-configured - config-derived certificate check (Good)ec2-network-acl-should-have-subnet-ids - association-aware approximation (Limited)secretsmanager-auto-rotation-enabled-check - secret-to-rotation relationship via core::getresources() (Good)s3-bucket-should-have-object-lock-enabled - object lock association approximation (Limited)ec2-vpc-default-security-group-no-traffic - inline-only approximation of a broader graph check (Not convertible as an exact translation)elasticsearch-in-vpc-only - config-to-end-state VPC placement approximation (Limited)cloudtrail-server-side-encryption-enabled - config-to-end-state encryption check (Good)step-functions-state-machine-logging-enabled - nested logging block conversion (Good)elasticache-redis-replication-group-encryption-at-transit-enabled - direct boolean check (Perfect)s3-block-public-access-bucket-level - variable and association heavy approximation (Not convertible as an exact translation)Note: The Sentinel policy files in this bundle come from the locally cloned policy library so reviewers can inspect the original Sentinel and converted tfpolicy side by side in one place.