> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-enterprise.md).
# Terraform Enterprise (Sentinel)
Integrate Prima Cloud with Terraform Enterprise (Sentinel) to enforce the policy as a code framework for Terraform workspaces that use [Sentinel language](https://www.terraform.io/cloud-docs/sentinel) with a predefined [enforcement level](https://www.terraform.io/cloud-docs/sentinel/manage-policies#enforcement-levels) that prevents any risky Terraform run. With the integration of Terraform Enterprise, Prisma Cloud will scan your Terraform frameworks for misconfiguration for Prisma Cloud default policies, out-of-the-box policies and custom policies.
Terraform Enterprise is a self-hosted version of Terraform Cloud deployed either on-premises or in your public cloud. While locally, Terraform requires a working directory to manage a collection of infrastructure resources using Terraform CLI, Terraform Enterprise manages multiple collections through [workspaces](https://www.terraform.io/cloud-docs/workspaces).
As an administrator or operator of Terraform Enterprise, you can create multiple workspaces, each configured with a specific requirement through a policy set. Policy sets are groups of policies for workspaces that you can configure using any version control system (VCS). A policy set can be configured either for a select workspace or all workspaces in your enterprise. In addition to creating policy sets, you can plan runs for workspaces and customize runs for specific workspaces. Each Terraform run checks Sentinel policies for global and customized policy sets.
Create Terraform Enterprise Sentinel policy sets from your version control system as code. You need two files to ensure a Terraform policy set runs:
* A Sentinel configuration file `(sentinel.hcl)` A Sentinel configuration file contains the policy name, the enforcement level of the policy, and the source path of the policy. You are required to define the actual path for a policy source in the Sentinel configuration file.
* Policy file `(policyname.sentinel)` Policy file `(policyname.sentinel)` are individual policy files that are created in the same path as the Sentinel configuration file. The name of the policy file must be the same as the policy name in the configuration file with a `.sentinel`.
1. Verify prerequisites.
For Terraform Enterprise (Sentinel) integration with Prisma Cloud Application Security, you need access and information to multiple environments.
* **Access Key**
The Prisma Cloud access key enables you to integrate Sentinel files with Prisma Cloud console and Terraform Enterprise console. If you do not have an access key, see generate access key.
* **Secret Key**
The Prisma Cloud secret key generates with your access key. Save your secret key once it is generated, as you cannot view it again on Prima Cloud.
The Access Key and Secret Key help initiate the integration from Prisma Cloud to Terraform Enterprise (Sentinel).
* **Terraform Enterprise Console**
Access to Terraform Enterprise Console enables you to provide Admin user token, Terraform Enterprise URL, configure policy sets, and Sentinel Parameters. The Terraform Enterprise (Sentinel) User token or Team token authorizes Prisma Cloud to access to your workspaces and helps create sentinel configuration file and policy file. The user or team must either have the **Manage Workspaces** permission at the organization level or admin permission on the workspace(s) being integrated.
* **Cloud Database**
Access to the cloud database enables you to verify the Prisma Cloud integration through sentinel files.
2. Integrate Terraform Enterprise (Sentinel) with Prisma Cloud.
1. Select **Settings > Repositories > Add Repository**.
2. Select **Terraform Enterprise (Sentinel)**.
3. Add **Terraform Enterprise URL**.
Ensure an IP address and your Terraform Enterprise URL are on the allow list for Prisma Cloud. To know more about the allow list see [allow list](/content-collections/get-started/console-prerequisites.md).
4. Add **Terraform Enterprise User / Team token** and then select **Next**.
3. Create Sentinel files within your version control system.
You need two Sentinel files — `sentinel.hcl`, which defines the relevant policies, and `prismacloud.sentinel`, which contains the actual policy logic - to ensure Terraform policy set runs with Prisma Cloud configurations.
1. Create a `sentinel.hcl` file in your VCS (version control system).
2. Copy and then paste the code from Prisma Cloud console in the new `sentinel.hcl` file.
The code helps you define your policy and the enforcement level of the policy within Terraform Enterprise. The enforcement level can be set to one of three values:
* `hard-mandatory` means your Terraform cannot be applied until you resolve or suppress all failing Application Security policies.
* `soft-mandatory` means your Terraform runs are blocked but can be overridden to still apply the IaC
* `advisory` means Application Security will report and record policy violations but will not block a Terraform apply.
3. Optionally, you can edit the default source path `./prismacloud.sentinel` to the location of another sentinel file in the code and then **Next**.
We recommend using the default value `./prismacloud.sentinel`.
4. Create a `prismacloud.sentinel` file in your VCS (version control system).
5. Copy and then paste the code from Prisma Cloud console in the new `prismacloud.sentinel` file (or another file if you are not using the default value), and then select **Next**.
4. Create Sentinel Policy Sets on Terraform Enterprise console.
1. Access Terraform Enterprise console and then select **Settings > Policy sets > Connect a new policy set > Add new Sentinel parameters**.
2. Define the scope of the policy set.
You can enforce policies for a single workspace or to all workspaces.
3. Add the Prisma Cloud **Access Key** and Prisma Cloud **Secret Key** and then select **Save policy set**.
4. Access the Prisma Cloud console and then select **Next**.
5. Connect Policy Set on Terraform Enterprise (Sentinel).
1. On the Prisma Cloud console select the organization to integrate the policy set and then select **Next**.
2. Access Terraform Enterprise console and then select **Workspaces > Workspace > Actions >Start new plan**.
3. Select **Start Plan** to run the new policy set for the resources.
Terraform triggers the plan for the workspace.
6. Verify the Terraform Enterprise (Sentinel) integration with Prisma Cloud.
1. Access your cloud database to verify the Sentinel files (``.sentinel `and `sentinel.hcl``) integration.
In this example, in your cloud database, you can verify the `access_token` that is your Terraform user or team token and domain strings that are auto populated based on your token entry.
2. Access the Prisma Cloud console and then select **Done**.
Access **Application Security > Projects** to view the latest integrated Terraform Enterprise (Sentinel) repository. [Suppress or Fix](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-fix-issues-in-scan.md) the policy misconfigurations if any are detected.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-enterprise.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.