$ the-wire · showcase
Policy library hits 1.0 with 546 policies
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
HashiCorp's prewritten Terraform policy library reached general availability at v1.0.0, and the same 24 hours brought 43 new AWS, GCP, and Azure policies covering AI security, CIS benchmarks, and cloud identity controls.
v1.0.0 hashicorp/prewritten-terraform-policy-library
First general availability release, adding 151 policies to reach 546 total, with coverage spanning AWS Foundational Security Best Practices (340 policies) and four CIS AWS Foundations Benchmark versions (44 policies). This is the release to pin if you were tracking pre-1.0 builds; the policy set is 1.0 stable from here.
feat(aws): add Bedrock, Bedrock AgentCore and SageMaker Security Hub policies with docs hashicorp/prewritten-terraform-policy-library
Four new policies close gaps in AWS's AI Security Best Practices standard for Bedrock, Bedrock AgentCore, and SageMaker controls that had no policy in the library. Notably, the source notes these controls exist only in the AI Security standard and appear in none of FSBP, CIS, NIST SP 800-53, or PCI DSS, so teams auditing AI workloads have no equivalent coverage without them.
feat(gcp): add 22 CIS foundation controls hashicorp/prewritten-terraform-policy-library
Twenty-two GCP policies land against the CIS Google Cloud Platform Foundation Benchmark, spanning identity management, logging and monitoring, and DNSSEC. The identity set is the concrete part: GCP-managed-only service-account keys, non-public KMS keys, 90-day-or-less key rotation, and API keys restricted to required APIs.
feat(azure): add 17 CIS network, monitoring, and storage policies hashicorp/prewritten-terraform-policy-library
Seventeen CIS Azure Foundations Benchmark v6.0.0 policies arrive with matching tests and docs, weighted toward network security with eight rules covering VPN point-to-site Entra ID-only authentication, Application Gateway WAF and TLS 1.2-or-later configuration, and subnet NSG associations.
feat(aws): add Bedrock, Bedrock AgentCore and SageMaker Security Hub policies with docs (#78) hashicorp/prewritten-terraform-policy-library
The Bedrock, AgentCore, and SageMaker policies require Google provider 6.67.0 or later, and each ships a test file with pass and fail cases plus documentation carrying its tfpolicy test trace. The long tail is a dependency bump in the Google Compute Packer plugin, moving packer-plugin-sdk from 0.6.11 to 0.6.12.
