terraform-compliance

Visit Website

Introduction

terraform-compliance describes itself as a lightweight, security-focused BDD test framework against Terraform. You write rules as Gherkin feature files, for example ‘Given I have AWS S3 Bucket defined, Then it must contain server_side_encryption_configuration’, and run them against the JSON output of terraform plan.

Because it reads the plan rather than the source, it sees resolved values, module outputs and computed defaults. The plain-English steps make policies readable for auditors and security teams who do not write code.

In the quality loop it is a pre-apply gate in CI.

The source code is at terraform-compliance/cli on GitHub under the MIT licence, with about 1,500 stars; the most recent commit was on 22 October 2026.

Features

1. Gherkin rules: Readable Given, When, Then policies.
2. Plan-based: Evaluates resolved Terraform plan JSON.
3. Negative testing: Express what must not exist.
4. Docker image: Run without local Python setup.
5. CI friendly: Non-zero exit on failed scenarios.
6. Tags: Select subsets of rules.

Pros

1. Readable for non-developers: Policies double as documentation.
2. Free to use: Open source under the MIT licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 22 October 2026.

Cons

1. Narrow scope: Terraform only.
2. Step vocabulary: You are limited to the provided step definitions.
3. Smaller community: Fewer shared rule sets than Checkov or OPA.

Usage and Links (Example)

Feature: S3 encryption
  Scenario: Buckets are encrypted
    Given I have aws_s3_bucket defined
    Then it must contain server_side_encryption_configuration

terraform plan -out plan.out && terraform show -json plan.out > plan.json
terraform-compliance -p plan.json -f ./compliance

Resources:

• terraform-compliance website
• GitHub repository

Pricing

terraform-compliance is free and open source under the MIT licence.

Recommended for?

1. Security teams that want readable Terraform policies.
2. Regulated environments that must show auditors what is enforced.

Conclusion

terraform-compliance makes Terraform policy readable to everyone.

Choose it when readability matters more than policy-language power.

On CheckOps, terraform-compliance is filed under the Release & CI gates and Security testing stages. Related tools listed here include Terratest, Test Kitchen, Molecule, Goss, Chef InSpec and Container Structure Test. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.