メニュー
Use when converting HashiCorp Sentinel policies to ORL and you need the state/plan vs source-AST paradigm and conversion limits. No side effects.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_know_sentinel_conversion |
| description | Use when converting HashiCorp Sentinel policies to ORL and you need the state/plan vs source-AST paradigm and conversion limits. No side effects. |
.tf (and related) files before apply.Conversion is not 1:1. Some Sentinel checks have no ORL equivalent (computed outputs, deep cross-module resolution).
| Sentinel intent | ORL approach |
|---|---|
| Fixed attribute / boolean | FULL_REMEDIATION |
| Value depends on org context | AUDIT_ONLY |
| Only visible in plan/state | Document as unconvertible / manual |
Determine what kind of ORL rule(s) to create:
| Sentinel Pattern | ORL Strategy | Reason |
|---|---|---|
Checks a single attribute value (e.g., encryption = true) | Fix rule — replace/insert the correct value | Deterministic, safe to auto-fix |
Checks attribute is present (e.g., tags must exist) | Fix rule — insert default if missing | Deterministic with a known default |
Checks attribute references a specific resource type (e.g., ami must reference data.aws_ami) | Fix rule — replace with data source reference | Deterministic if a canonical pattern exists |
| Checks computed values, cross-module refs, or runtime state | Audit-only rule — flag the pattern, no auto-fix | Cannot determine correct value from source code alone |
| Checks values that depend on user/org context (e.g., allowed VPC IDs, approved AMI owners) | Fix with variables or Audit-only | Needs user input or org-specific config |
Present the strategy to the user before proceeding:
Sentinel policy analysis:
Policy: require-most-recent-ami-version
Severity: hard-mandatory
Target resources: aws_instance, data.aws_ami
Conversion plan:
1. [FIX] aws_instance ami must reference data.aws_ami (replace hardcoded AMIs)
2. [FIX] data.aws_ami must have most_recent = true
3. [FIX] data.aws_ami must have valid owners
4. [AUDIT-ONLY] data.aws_ami must have approved name filter (org-specific)
Proceed? [Y/n]
Be transparent with the user about what cannot be converted:
| Sentinel Capability | ORL Equivalent | Notes |
|---|---|---|
tfplan.resource_changes — checks planned changes | No direct equivalent | ORL works on source code, not plan output |
tfstate — checks current state | No direct equivalent | ORL cannot read remote state |
tfrun — checks workspace metadata | No equivalent | Runtime context not available at source level |
tfconfig.module_calls — checks module composition | Partial — can check .tf files in modules | Cannot resolve remote module sources |
| Cross-resource references (e.g., "security group must reference this VPC") | Audit-only | Cannot validate computed references from source |
Computed values (count.index, each.key) | Skip these | Variables/expressions should not be modified |
print() statements | Omit | Sentinel debugging, no ORL equivalent |
find_resources_being_destroyed() / filter_attribute_was_value(...) — blocks a destroy plan when an attribute was a given value | No direct equivalent | ORL cannot see destroy actions or prior state. Do not invent a substitute mechanism (e.g. lifecycle.prevent_destroy) the policy never references — instead convert the referenced attribute itself into a straightforward fix rule (e.g. deletion_protection must be true), and note in Limitations that the destroy-time enforcement itself isn't reproducible. |
When a Sentinel check cannot be converted, explain why and suggest the closest ORL alternative (usually audit-only). The closest alternative is the attribute the policy actually inspects — never substitute a different, unreferenced Terraform mechanism just because it achieves a similar-sounding outcome.
lifecycle.prevent_destroy for a deletion_protection check) even if it seems like a plausible-sounding proxy.gomboc_community_flow_convert_sentinel for the full pipeline.