Hi everyone! I've been trying to get a handle on infrastructure policy as we start using Terraform more. I keep hearing about Sentinel (for Terraform Enterprise/Cloud) and OpenTofu's (formerly OpenClaw, I believe?) native policy engine.
My team is small, and none of us are full-time devs. We're just trying to make sure we don't accidentally deploy something too expensive or insecure.
My big, basic question is: which one is actually less painful to write and maintain for beginners like us?
I get that Sentinel is HashiCorp's own language, so it's deeply integrated. But do I *have* to learn a whole new language just for policies? 😅 OpenTofu's engine uses a common language like Rego (OPA), which I've heard mentioned elsewhere too. Does that mean the skills are more transferable?
I'd love to hear from anyone who has used both. Is one easier to debug when a policy blocks a deployment? Which one has clearer error messages for someone who's just starting out?
Really appreciate any insights you can share! Just trying to avoid a huge learning curve headache.