terraform-compliance
terraform-compliance is a free, open-source framework for testing Terraform infrastructure code against security and compliance policies before deployment.
What terraform-compliance is
terraform-compliance is a free, open-source framework for testing Terraform infrastructure code against security and compliance policies before deployment. It evaluates Terraform plan or state output, including plans converted to JSON, using policies written as behavior-driven feature files. A scenario uses Given steps to establish its context, When steps to filter that context, and Then steps to fail when conditions are unmet. Feature files can be loaded from a directory or a Git repository; SSH key authentication is available for private repositories. The project says it works with any Terraform provider and supports Terraform versions newer than 0.12. Checks can run in a pipeline or through git hooks, and documentation includes CircleCI and GitHub Actions examples. Installation is available through pip, which requires Python 3.x, or Docker. Controls can turn failures into warnings, fail scenarios when steps skip, enforce case-sensitive matching, or exclude resources. The project uses the MIT license and supports policy testing, admission control, and policy reporting, but not runtime enforcement.
Good
- Works with any Terraform provider
- Feature files can be stored in Git
- Checks can run in pipelines or git hooks
- Offers CircleCI and GitHub Actions examples
- Free to use under the MIT license
Watch out
- Requires Terraform plan or state output
- pip installation requires Python 3.x
- Does not provide runtime enforcement
Who it suits
It suits developers and security teams who want readable policy tests for Terraform plans and can supply plan or state output. Teams can also keep the feature files in a separate repository owned by another group.
Verdict
terraform-compliance gives teams a BDD-style way to check Terraform changes against security and compliance rules before deployment. It supports common CI workflows, but its scope is Terraform plan and state testing rather than runtime enforcement.
Plans and prices
From terraform-compliance's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| terraform-compliance | Free | Open-source Terraform compliance testing framework |
The facts
Each one read from terraform-compliance's own pages, with the date it was checked.
What it does
- BDD behavior
- Given steps set the test context, When steps filter it, and Then steps fail the scenario when their conditions are not met.checked 4 Oct 2026
- CI integrations
- The documentation includes CI/CD examples for CircleCI and GitHub Actions.checked 4 Oct 2026
- Compliance controls
- Supported tags include ways to turn failures into warnings, fail scenarios when steps skip, match case sensitively, and exclude resources.checked 4 Oct 2026
- Feature sources
- Feature files can be read from a directory or a Git repository, with SSH key authentication available for private repositories.checked 4 Oct 2026
- Install options
- The documentation provides installation through pip and Docker; pip installation requires Python 3.x.checked 4 Oct 2026
- Intended users
- The project describes policies that developers and security teams can read and says tests can be kept in a separate repository owned by another team.checked 4 Oct 2026
- License
- The maker’s site says the project is open source, free to use, and distributed under the MIT license.checked 4 Oct 2026
- Policy tests
- It tests Terraform plans against policies written as behavior-driven development features and scenarios.checked 4 Oct 2026
- Provider support
- The project says it works with any Terraform provider.checked 4 Oct 2026
- Purpose
- terraform-compliance is a lightweight, security- and compliance-focused test framework for negative testing of infrastructure as code written with Terraform.checked 4 Oct 2026
- Terraform input
- The tool requires a Terraform plan or state output as input and can also run against JSON-converted plan output.checked 4 Oct 2026
- Terraform version support
- The overview says terraform-compliance supports Terraform versions newer than 0.12.checked 4 Oct 2026
- Validation timing
- The project describes validating code before deployment and running checks in a pipeline or git hooks.checked 4 Oct 2026
Alternatives to terraform-compliance
- 1
Terraform
Free planWebAPILinuxmacOS8.0Free plan - 2
AWS CloudFormation
Free planiOSWebAPILinux7.7Free plan - 3
Kyverno
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4
Open Policy Agent Gatekeeper
Free planOpen sourceAPILinuxSelf-hosted7.2Free plan - 5
Fairwinds Polaris
Free planWebLinuxmacOSSelf-hosted7.1Free plan - 6
Google Cloud Organization Policy
Free planWebAPILinuxmacOS7.1Free plan