Instead of Conftest
Conftest alternatives
Conftest is a free, cross-platform utility for testing structured configuration in CI. It applies Open Policy Agent’s Rego language to deny, violation, and warn rules, with namespaces and policy unit tests. Inputs can be files, directories, multiple files, or standard input, covering Kubernetes configurations, Terraform-related data, HCL, JSON, YAML, Dockerfiles, JSONnet, TOML, XML, and more. Results can be emitted as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF. Policies and plugins can be shared through several repositories and registries, and documented integrations include CircleCI, GitHub Actions, and Tekton Pipelines.
- 1
AWS CloudFormation
Free plan APIiPhoneLinux+3AWS infrastructure provisioning and multi-account deployments — CloudFormation provisions AWS and third-party resources, with StackSets, change previews, drift detection, CDK, and SAM that Conftest does not provide.
- 2
kube-score
Free plan LinuxMacSelf-hosted+2Kubernetes security and resilience checks — kube-score focuses on Kubernetes object recommendations such as probes, limits, security context, and disruption policies, unlike Conftest’s general policy utility.
Open source Visit site - 3
cfn-lint
Free plan LinuxMacSelf-hosted+1CloudFormation template validation — cfn-lint validates CloudFormation schemas, properties, SAM templates, and custom rules, while Conftest handles broader structured data through Rego.
Open source Visit site - 4
Chef InSpec
Free plan Open source APILinuxMac+2Compliance audits against live infrastructure — Chef InSpec tests actual applications and infrastructure against desired states, with cloud resources, reusable profiles, and compliance reporting beyond Conftest’s input testing.
Free plan · paid from $59/yr · 30-day trial Visit site - 5
Cinc Auditor
Free plan LinuxMacWindowsFree InSpec-compatible compliance workflows — Cinc Auditor distributes Chef InSpec with compatible profiles, tools, wrappers, and a CI-ready container, whereas Conftest uses Rego for configuration policies.
Free plan Visit site - 6
KICS
Free plan LinuxMacSelf-hosted+1Broad Infrastructure-as-Code security scanning — KICS scans many IaC technologies for vulnerabilities, compliance issues, and misconfigurations with editable queries and extensive CI integrations, unlike Conftest’s Rego model.
- 7
kubeconform
Free plan LinuxMacSelf-hosted+1Fast Kubernetes manifest schema validation — Kubeconform validates Kubernetes manifests against OpenAPI schemas with concurrent processing, caching, custom schema locations, and offline support rather than general policy rules.
Free plan Visit site - 8
Kyverno
Free plan Open source APILinuxMac+3 - 9
Open Policy Agent Gatekeeper
Free plan Open source APILinuxSelf-hosted - 10
Cloud Custodian
Free plan LinuxMacSelf-hosted+1 - 11
Fairwinds Polaris
Free plan LinuxMacSelf-hosted+2 - 12
Google Cloud Organization Policy
Free plan APILinuxMac+2 - 13
Checkov
Free plan LinuxMac - 14
Google Cloud Terraform Policy Validation
Free plan LinuxMacWindows - 15
KubeLinter
Free plan LinuxMacSelf-hosted - 16
Open Policy Agent
Free plan APILinuxMac+3 - 17
Terraform
Free plan APILinuxMac+3 - 18
Kubewarden
Free plan LinuxMacSelf-hosted+1 - 19
PolicyForge
Free plan LinuxSelf-hostedWeb - 20
terraform-compliance
Free plan LinuxSelf-hosted - 21
Tirith
Free plan Linux - 22
Firefly
Free trial APISelf-hostedWeb - 23
Azure Policy
Free plan Web - 24
Google Cloud Policy Controller
Free plan Web - 25
Nirmata Enterprise for Kyverno
Paid LinuxSelf-hosted5.2 Visit site - 26
Chef InSpec
Paid LinuxMacWindows - 27
AWS CloudFormation Guard
Paid LinuxMacWindows - 28
Terraform Test Framework
Paid LinuxSelf-hosted - 29
HashiCorp Sentinel
Paid LinuxMacWindows
← Back to Conftest The whole infrastructure policy as code tools list