> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-cloud-sentinel.md). # Terraform Cloud (Sentinel) Integrate Prisma Cloud with Terraform Cloud (Sentinel) to allow dynamic, automated, and context-specific scans within your development Terraform workspace that uses [Sentinel language](https://www.terraform.io/cloud-docs/sentinel). With the integration of Terraform Cloud, Prisma Cloud will scan your Terraform frameworks to identify misconfigurations according to Prisma Cloud’s default policies, out-of-the-box policies, and custom policies. This involves continuous scanning of your workflow whenever changes are pushed or triggered, integrating security checks, and identifying issues such as misconfigurations in your infrastructure-as-code (IaC) files, software composition analysis (SCA) vulnerabilities, exposed secrets and license non-compliance as soon as they are introduced. Each identified issue can either be resolved or suppressed on the Prisma Cloud console. Additionally, Prisma Cloud offers automated shift-left actions such as notifying developers or creating tickets, based on scan results. Integrating Terraform Cloud (Sentinel) with Prisma Cloud is performed at the workspace level. This means that you need to set up the integration between Terraform Cloud (Sentinel) with Prisma Cloud for each workspace that you intend to scan. The following integration includes workflows involving third party tools such as Terraform and GitHub. These are general guidelines only, intended to help you. You must always follow the official third party documentation. Before you begin, [Generate and copy the Prisma Cloud access key](/content-collections/administration/create-access-keys.md) to enable access to Prisma Cloud. The access key includes a key ID and secret. ## On GitHub 1. Create a GitHub repository with a Terraform file. Make sure you have **Administrator** permissions * Create a file in your Terraform file repository at the root level of the project > name the file `sentinel.hcl` * Create a second file in your Terraform file repository at the root level of the project > name the file `prismacloud.sentinel` 2. Procure a license for Prisma Cloud with the Application Security module enabled 3. Procure a [Terraform cloud license](https://www.hashicorp.com/products/terraform/pricing) that is either a trial license or a TF Cloud license at the TEAM & GOVERNANCE level 4. On Terraform: Grant the user or team the following permissions: **Manage Workspaces** permissions at the organization level or **Administrator** permissions on the workspace(s) being integrated. ## On Terraform Cloud 1. Create a new organization if you do not have one by filling in a value for the **Organization Name** and then providing your email address. 2. **Create a workspace**. 1. Select **New Workspace**. 2. In the **Choose Type** step of the **Create a new workspace** page, select **Version control workflow**. 3. Select your version control provider, eg GitHub. For GitHub, sign into your GitHub account and ensure the Oauth scope includes the repository that hosts your Terraform files (see prerequisites). 4. Select a repository that will host your Terraform source code. 5. Copy and save the **Workspace Name** and save it as **WORKSPACE\_NAME**. 6. Copy the **Workspace ID** and save it as **WORKSPACE\_ID**. 3. Create a Terraform **api token** for your user. 1. Select your user/profile icon > **User Settings**. 2. Select the **Tokens** section from the left side menu. 3. Click **Create an API token** and provide a description > Select **Create API token**. 4. Copy and save the token as **TF\_USER\_TOKEN** > **Done**. To retrieve workspace name and ID: Select the top left hand banner > choose your organization from the 'Choose an organization' dropdown > Select the workspace you created. ## On Prisma Cloud console 1. Select **Settings** > **Code & Build Providers** > **Add** > **Terraform Cloud (Sentinel)** (under CI/CD Runs). The **Configure Workspace** step of the integration wizard opens. 2. Fill in the provided fields: * **Workspace Id** * **Workspace Name** * **Terraform User or Team Token** * **Workspace Description** The values are those you generated when creating the workflow in Terraform. All fields including the workspace description, are required. Make sure that the Workspace name is identical to the workspace name in Terraform Cloud. 3. Select **Next**. 4. Copy the policy code in the **Create sentinel.hcl** step of the wizard > **Next**. 5. Copy the policy code in the **prismacloud.sentinel** step of the wizard > **Next**. The **Connect Policy Set** of the integration wizard is displayed, redirecting to Terraform Cloud. ## On GitHub 1. In the Terraform repository that you created (see prerequisites above): 1. Paste the policy code copied in the **Create sentinel.hcl** step of the wizard in the `Create sentinel.hcl` file. 2. Paste the policy code copied in the **prismacloud.sentinel** step of the wizard in the `prismacloud.sentinel` file. ## On **Terraform Cloud** 1. Create a new policy set 1. Select the top left hand banner > **Settings** > **Select policy sets** > **Connect a new policy set**. 2. Select 'GitHub' as your version control provider. 3. Select the Terraform repository that contains your terraform files and policies that you created. 4. Select the default **Scope** of the policies as enforced on all workspaces. 5. Click **Connect Policy Set**. 2. Add parameters. 1. Select the policy set you created. 2. Select **+ Add Parameter** > provide the access key ID generated in the prerequisites above: PRISMA\_ACCESS\_KEY. 3. Select **+ Add Parameter** > provide the Secret key generated in the prerequisites above: PRISMA\_SECRET\_KEY. ## Verify Integrations on Prisma Console In **Application Security**, select **Settings** > **CI/CD Runs** tab. Your integrated Terraform repositories will be displayed. The next Terraform scan will automatically include the selected repositories. ## Monitor and Manage Scan Results To view scan results and resolve issues, select **Application Security** > **Projects** > **CI/CD Runs** tab. See [here](/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-code-build-issues.md) for more information. ## Verify integration in Terraform Cloud Access **Workspaces** > **Workspace** > **Actions** > **Start new plan** to validate the new policy set against the workspace. Your integrated Terraform repositories will appear on the **Repositories** page. The next Terraform scan will include these repositories. To view scan results and resolve issues, select **Application Security** > **Projects** > **CI/CD Runs** tab. See [here](/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-code-build-issues.md) for more information. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-cloud-sentinel.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.