Conftest

Conftest is a policy testing framework that validates structured configuration files against Open Policy Agent (OPA) policies. It works with Terraform, Kubernetes manifests, Dockerfiles, serverless configs, and any other structured data format.

Unlike scanners with built-in check libraries, Conftest requires you to define policies in Rego. This gives complete control over what gets tested and how failures are reported.

What Conftest does

Conftest parses configuration files into data structures and evaluates them against Rego policies. Policies define rules like “all S3 buckets must enable encryption” or “container images must not run as root.”

The tool outputs pass/fail results with custom messages. It runs locally during development, in CI/CD pipelines, and as a pre-commit hook.

Key features

Writing policies

Policies live in Rego files. Define rules in the deny, warn, or violation namespaces to control failure severity.

Example policy for Kubernetes resources:

package main

deny[msg] {
  input.kind == "Deployment"
  not input.spec.template.spec.securityContext.runAsNonRoot
  msg = "Deployment must set runAsNonRoot to true"
}

warn[msg] {
  input.kind == "Service"
  input.spec.type == "LoadBalancer"
  msg = "LoadBalancer services may incur cloud costs"
}

Run conftest test deployment.yaml to evaluate Kubernetes manifests against these policies.

Testing Terraform

Point Conftest at Terraform JSON plan output or HCL source files. Policies check resource configurations before infrastructure changes apply.

# Test Terraform HCL files
conftest test terraform/*.tf

# Test Terraform plan output
terraform plan -out=plan.binary
terraform show -json plan.binary > plan.json
conftest test plan.json

Example Terraform policy:

package main

deny[msg] {
  input.resource.aws_s3_bucket[bucket]
  not input.resource.aws_s3_bucket[bucket].server_side_encryption_configuration
  msg = sprintf("S3 bucket '%s' must enable encryption", [bucket])
}

CI/CD integration

Conftest runs in any pipeline as a standalone binary. Exit codes indicate policy violations.

# Install Conftest
curl -L -o conftest.tar.gz https://github.com/open-policy-agent/conftest/releases/download/v0.66.0/conftest_0.66.0_Linux_x86_64.tar.gz
tar xzf conftest*.tar.gz

# Test configuration files
conftest test k8s/*.yaml --policy policies/

# Fail pipeline on violations (exit code 1)
conftest test terraform/ --fail-on-warn

GitHub Actions example:

- name: Run Conftest
  run: |
    conftest test kubernetes/*.yaml

Policy distribution with OCI

Store policies in OCI-compliant registries like Docker Hub, GitHub Container Registry, or AWS ECR. Teams pull policies from a central location instead of duplicating policy files across repositories.

# Push policy bundle to registry
conftest push ghcr.io/myorg/policies:latest

# Pull and test with remote policies
conftest test --update ghcr.io/myorg/policies:latest kubernetes/*.yaml

Getting started

When to use Conftest

Conftest works well when you need custom policy enforcement across different configuration formats. Teams with specific compliance requirements, internal security standards, or multi-cloud environments benefit from writing policies once and applying them to Terraform, Kubernetes, and other tools.

The Rego learning curve is steeper than tools with pre-built checks like Checkov or KICS. But once policies are written, Conftest provides precise control over what passes and what fails.

Use Conftest alongside other scanners. Run Trivy for vulnerability detection and Conftest for organization-specific policy enforcement. They complement each other.

For pre-built IaC check libraries, Checkov covers more scenarios out of the box. For Terraform-focused scanning with commercial support, Snyk IaC offers IDE integration and fix suggestions.

Browse other IaC security tools to compare options.

Frequently Asked Questions