# Terraform sentinel policy failed

**URL:** <https://discuss.hashicorp.com/t/terraform-sentinel-policy-failed/20871>\
**Category:** Terraform\
**Created:** [February 11, 2021, 11:10pm UTC](https://discuss.hashicorp.com/t/terraform-sentinel-policy-failed/20871 "2021-02-11T23:10:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![chiranjeevpanjwani](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/chiranjeevpanjwani/32/16109_2.png) [@chiranjeevpanjwani](https://discuss.hashicorp.com/u/chiranjeevpanjwani)\
**Post date:** [February 11, 2021, 11:10pm UTC](https://discuss.hashicorp.com/t/terraform-sentinel-policy-failed/20871/1 "2021-02-11T23:10:31Z")

</div>

My requirement is that the sentinel policy should allow only the following types of persistent volumes in AKS - azure\_disk",“azure\_file”,“csi”,“flex\_volume”.

The policy that I wrote:

```auto
import "tfplan-functions" as plan

aksstorage = plan.find_resources("kubernetes_persistent_volume")

allowed_storage = ["azure_disk","azure_file","csi","flex_volume"]
                    
violating_storage = plan.filter_attribute_not_in_list(aksstorage,
                    "spec.0.persistent_volume_source", allowed_storage, true)
                    
# Main rule
violations = length(violating_storage["messages"])                    

main = rule {
  violations is 0
}

```

I am getting the below error.

> kubernetes\_persistent\_volume.example has spec.0.persistent\_volume\_source with value [{azure\_disk: , glusterfs: , cinder: , iscsi: , flocker: , local: , nfs: , photon\_persistent\_disk: , csi: , fc: , ceph\_fs: , flex\_volume: , vsphere\_volume: [{fs\_type: null, volume\_path: /absolute/path}], host\_path: , gce\_persistent\_disk: , azure\_file: , rbd: , quobyte: , aws\_elastic\_block\_store: }] that is not in the allowed list: [azure\_disk, azure\_file, csi, flex\_volume]

I am new to Terraform and unable to find a way to get this requirement fulfilled