Google Cloud Terraform Policy Validation vs HashiCorp Sentinel

Google Cloud Terraform Policy Validation checks Terraform plans against organizational security and governance constraints before infrastructure changes are applied. The `gcloud beta terraform vet` command evaluates Terraform plan JSON, retrieving project data through Google Cloud APIs. It can flag violations, issue warnings, or halt a deployment before production; it returns exit code 0 when no violations are found and 2 when they are. Platform teams can place validation between plan and apply in CI/CD workflows using Cloud Build, Jenkins, or GitHub Actions. The command accepts Terraform 0.12 or later plan JSON and requires a policy library and the Google Cloud CLI `terraform-tools` component. Policies can cover supported resources from Terraform's google and google-beta providers, and constraints can be reused with other tools that support the framework. The command is free and client-side. The feature is in Preview under Pre-GA terms, where support may be limited. Security Command Center IaC validation has separate requirements: Premium or Enterprise activation at the organization level and a specified role. That workflow also requires Terraform Google provider version 5.5 or later.

HashiCorp Sentinel has no write-up on Specifiction yet; its figures are above.