🏗️ Terraform Cloud & Enterprise

Remote execution, Sentinel policy, Private Registry, Teams

Terraform Associate · TF-Associate · ⏱️ 20 min · ❓ 4 savol

☁️ Terraform Cloud nima?

HashiCorp tomonidan managed Terraform backend. Remote execution — plan/apply Terraform Cloud da ishlaydi (lokal emas). State management — versioned, encrypted, locking built-in. VCS integration — GitHub/GitLab/Bitbucket pull request da auto-plan. Free tier: 500 resurs/oy.

📜 Sentinel Policy as Code

Terraform Cloud/Enterprise da. Plan dan apply gacha oraliqda policy tekshiradi. Soft mandatory — ogohlantirish, lekin o'tkazib yuborish mumkin. Hard mandatory — majburiy, override yo'q. Misol: "s3 bucket larning versioning yoqilgan bo'lsin", "instance type production da faqat t3+". Go DSL.

📦 Private Module Registry

Terraform Cloud/Enterprise da ichki modullarni saqlash. Semantic versioning. Teams va Organization darajasida access control. Module VCS repositorydan import qilinadi. Public Terraform Registry ga o'xshash UX, lekin private.

👥 Teams & Organizations

Organization — kompaniya, billing unit. Workspace — bitta Terraform root module + state. Teams — permission groups (read, plan, write, admin). SSO: Okta, Azure AD integratsiya (Enterprise). Audit Logging — kim nima qildi.

📊 Terraform Cloud vs Enterprise vs Open Source

Feature	Open Source	Cloud (Free)	Cloud (Plus)	Enterprise
Remote state	S3/GCS	✅ Built-in	✅	✅
Remote execution	❌	✅	✅	✅
Sentinel policy	❌	❌	✅	✅
SSO/SAML	❌	❌	✅	✅
Private Registry	❌	✅	✅	✅
Self-hosted	✅	❌	❌	✅

💡 Asosiy nuqtalar

Terraform Cloud: remote execution + state + VCS integration
Sentinel: policy as code (plan va apply orasida)
Hard mandatory: override yo'q. Soft mandatory: o'tkazib yuborish mumkin
Private Registry: ichki modullar versioning bilan
Workspace: bitta state = bitta environment

🎯 Imtihon maslahatlari

Sentinel — plan dan keyin, apply dan oldin ishlaydi: Plan → Sentinel → Apply
Hard-mandatory Sentinel: admin ham override qila olmaydi
Terraform Cloud Free: 500 resurs, unlimited workspaces, unlimited users
Remote execution: plan/apply Cloud da ishlaydi, lokal credentials kerak emas
run trigger: VCS commit → auto plan, PR approved → auto apply (optional)

⚠️ Ko'p adashadigan

Sentinel = OPA (Open Policy Agent) deb o'ylash — Sentinel HashiCorp tomonidan, TFCloud/Enterprise only
Workspace = Git branch deb o'ylash — workspace = alohida state file, environment analogiga yaqin
Terraform Cloud free = cheksiz deb o'ylash — 500 resurs/oy cheklov bor

🧠 Eslab qolish: "SRSP" = State (remote, versioned), Remote-execution (Cloud da run), Sentinel (policy), Private-registry — Terraform Cloud 4 asosiy feature