terraform-compliance

What terraform-compliance is

terraform-compliance is a free, open-source test framework for checking Terraform infrastructure as code against security and compliance policies. It takes Terraform plan or state output as input and can also work with plan output converted to JSON. The project says it supports Terraform versions newer than 0.12 and works with any Terraform provider.

Policies are written as behavior-driven feature files. In a scenario, Given steps establish context, When steps filter that context, and Then steps fail the scenario if their conditions are not met. Feature files can come from a directory or a Git repository; SSH key authentication is available for private repositories. Checks can run before deployment, in a pipeline, or through git hooks. Documentation includes CI/CD examples for CircleCI and GitHub Actions.

Installation options include pip, which requires Python 3.x, and Docker. Supported controls include treating failures as warnings, failing scenarios when steps skip, case-sensitive matching, and excluding resources. The project is distributed under the MIT license. It supports policy testing, admission control, CI/CD integration, and policy reporting, but does not provide runtime enforcement.

Who it suits

terraform-compliance suits developers and security teams who want to express Terraform security and compliance checks as readable BDD-style policies. It can also suit teams that keep policy files in a separate repository and run checks before deployment or in CI pipelines and git hooks.

Limits

The tool is for Terraform plan and state output, including JSON-converted plan output, and does not provide runtime enforcement.

Getting started

1. Visit https://terraform-compliance.com/.
2. Install through pip, which requires Python 3.x, or use Docker.
3. Provide Terraform plan or state output, or plan output converted to JSON.
4. Supply feature files from a directory or Git repository; use SSH key authentication for a private repository if needed.
5. Run checks before deployment, in a pipeline, or through git hooks.

Verdict

Pick terraform-compliance if you need free policy tests for Terraform and want rules expressed in readable scenarios. Look elsewhere if you need runtime enforcement or policy testing for infrastructure formats beyond Terraform plan and state output.