terraform-compliance

terraform-compliance -p plan.out -f <features>

Validates the Terraform plan against compliance features (BDD) with terraform-compliance, applying the organization's policies to the plan.

Run it in the IaC pipeline when you want plan validation against the organization's policies: terraform-compliance evaluates the plan (plan.out) against features written in Gherkin (BDD) — the organization's rules (resources with tags, private buckets, restricted CIDRs) — and reports the result of each feature. It's the behavior-driven validation (BDD) of IaC: readable and versioned policies. In DevSecOps, terraform-compliance is the pipeline gate: a plan that violates features is blocked before apply.

Don't use it without the plan: terraform-compliance evaluates the generated plan (terraform plan -out) — the pipeline generates the plan before validation. And watch out: features (Gherkin) are written in BDD format — the language curve and feature maintenance are the cost; simple rules (specific misconfigurations) are covered by scanners (tfsec, 045) and terraform-compliance for the organization's policies (tags, conventions). The combination of both is the complete pipeline.