Added lab 3

Author: kawsark

lab02/README.md

@@ -4,6 +4,8 @@ Duration: 45 minutes
 
 This lab demonstrates how to connect Terraform Enterprise to a source code management system (GitHub) and create a Workspace that can apply the Terraform configuration when changes are committed. This is called a [VCS-driven run workflow](https://www.terraform.io/docs/enterprise/run/ui.html).
 
+To perform this Lab you will create a new account in [Terraform Enterprise trial account](https://app.terraform.io/account/new), and create your own Organization within Terraform Enterprise.
+
 This lab is for use with a student's own AWS credentials and is intended to run on Terraform Enterprise, however, this lab can also be run locally, see [local.md](local.md) for steps.
 
 The Terraform configuration in this directory will provision one or more AWS EC2 instances and deploy an example Go application. To install the application, Terraform will generate a RSA SSH public and private key pair by Terraform using the Terraform [tls_private_key](https://www.terraform.io/docs/providers/tls/r/private_key.html) provider.
@@ -51,7 +53,7 @@ $ git clone https://github.com/$USER/aws-terraform-workshop.git
 
 #### Step 1.2: Connect GitHub to TFE
 
-Please go to [https://app.terraform.io](https://app.terraform.io) and create a new Organization. You’ll see an empty page where your workplaces will be.
+Please go to [https://app.terraform.io](https://app.terraform.io) and create a new Organization, or Navigate to an Organization you created earlier. The URL format is: `https://app.terraform.io/app/<your-organization-name>`
 
 - Go to [GitHub](https://github.com/settings/profile) and find your Settings page, accessed from the menu on your avatar.
 

lab03/README.md

@@ -1 +1,45 @@
-### Lab03 - Sentinel - to be implemented
+### Lab03 - Sentinel Policy as Code
+
+In this Lab we will continue to use your Organization we setup in lab02. Using Sentinel policy-as-code framework we will restrict the AWS EC2 instance type being deployed.
+- The Sentinel policy code is included in lab03 directory: [restrict-aws-instance-type.sentinel](restrict-aws-instance-type.sentinel).
+- You can view [example Sentinel policies on AWS](https://github.com/hashicorp/terraform-guides/tree/master/governance/aws) in terraform-guides repo.
+
+**Tasks:**
+- Task 1: Add Sentinel policy to Organization
+- Task 2: Queue a Plan
+- Task 3: View Sentinel policy failure and Override
+- Task 4: Destroy provisioned infrastructure
+
+### Terraform Enterprise
+
+### Task 1: Add Sentinel policy to Organization
+
+**Steps:**
+- Go to your Organization URL, which is in the format: `https://app.terraform.io/app/<your-organization-name>`
+- Click on Settings at the top
+- Click on "Sentinel policies" from the Organization Settings menu on the left
+- Click "Add New Policy"
+  - Set "POLICY NAME" to
+  - Set "ENFORCEMENT MODE" to soft-mandatory (can override)
+  - In "POLICY CODE", add the contents of [restrict-aws-instance-type.sentinel](restrict-aws-instance-type.sentinel).
+
+- Click "Create policy"
+
+### Task 2: Queue a plan
+
+**Steps:**
+- Click on "Workspaces" from the top, and click on the Workspace you used for lab02.
+- Click on "Queue plan" from the top.
+
+### Task 3: View Sentinel policy failure and Override
+
+**Steps:**
+- The Run should show a Policy failure. View the Allowed EC2 instance types in Sentinel Policy code. You will see it is restricted to `t2.small`.
+- Our [main.tf](../lab02/server/main.tf) is using an instance type of `t2.medium` which is causing the Policy to fail.
+- Since you are the owner of the Organization, you are able to Override this Policy failure.
+  - Click on "Override" button Optionally adding some comments
+  - Click on "Confirm and Apply" button to allow the Run to complete.
+
+### Task 4: Destroy provisioned infrastructure
+**Steps:**
+- Use the same steps as Lab02 to Destroy provisioned infrastructure

lab03/restrict-aws-instance-type.sentinel

@@ -0,0 +1,31 @@
+import "tfplan"
+
+# Get all AWS instances from all modules
+get_aws_instances = func() {
+    instances = []
+    for tfplan.module_paths as path {
+        instances += values(tfplan.module(path).resources.aws_instance) else []
+    }
+    return instances
+}
+
+# Allowed Types
+allowed_types = [
+  "t2.small"
+]
+
+aws_instances = get_aws_instances()
+
+# Rule to restrict instance types
+instance_type_allowed = rule {
+    all aws_instances as _, instances {
+      all instances as index, r {
+  	   r.applied.instance_type in allowed_types
+      }
+    }
+}
+  
+# Main rule that requires other rules to be true
+main = rule {
+  (instance_type_allowed) else true
+}