Infrastructure as Code has shifted the way organizations provision cloud resources, but the ability to declare infrastructure quickly also introduces the risk of deploying insecure, non-compliant, or poorly governed configurations. Terraform compliance is the practice of validating Terraform code and plans against security standards, regulatory requirements, and internal organizational rules before resources are created in the cloud. It moves validation left in the delivery pipeline and replaces manual reviews with automated, repeatable checks.
Terraform itself is a marvellous abstraction layer for any API that creates, updates, or destroys entities and provides the capability to ensure everything is up-to-date between the local configuration and the remote API responses. Given the fact Terraform is used mostly against Cloud APIs, what was missing is to ensure the code deployed against the infrastructure follows specific policies. Compliance is a critical concern for organizations deploying cloud infrastructure. Integrating compliance tools into the Terraform workflow ensures that infrastructure changes meet security standards and regulatory requirements before they are applied.
What Terraform Compliance Means
Terraform compliance and governance is the practice of ensuring Terraform-managed infrastructure meets external regulatory frameworks and internal organizational rules around cost, tagging, naming, and access. The primary mechanism is policy as code: rules written in a policy language and enforced by an engine that scans Terraform plans before apply.
Compliance in Terraform focuses on meeting specific external standards, while governance is the broader system of internal rules controlling how infrastructure is provisioned, including cost limits, tagging, naming, and approval workflows. Compliance is a subset of governance.
Without compliance checks, Terraform can deploy any configuration a developer writes, including configurations that violate security best practices or regulatory requirements. Compliance integration adds guardrails that prevent non-compliant infrastructure from being provisioned. It is typically enforced through policy-as-code tools which scan plans for violations during the CI/CD workflow.
Core Goals of Compliance Testing
- Compliance: Ensure the implemented code is following security standards and your own custom standards
- Behaviour driven development: BDD for IaC, enabling shared understanding between developers, testers, and security teams
- Pre-deploy validation: It validates code before it is deployed
- Policy as code enforcement: Rules are versioned, reviewed, and tested like application code
terraform-compliance as a Negative Testing Framework
terraform-compliance is a lightweight, security and compliance focused test framework against Terraform to enable negative testing capability for infrastructure-as-code. It is free-to-use and open source, providing functionality similar to HashiCorp Sentinel for Enterprise Products but for Terraform while remaining free to use.
Key design characteristics include:
- Compliance: Ensure the implemented code is following security standards, your own custom standards
- Behaviour driven development: BDD for nearly everything, why not for IaC
- Portable: just install it from pip or run it via docker
- Provider agnostic: it works with any provider
- Easy to integrate: it can run in your pipeline or in git hooks to ensure all deployments are validated
- Segregation of duty: you can keep your tests in a different repository where a separate team is responsible
- Pre-deploy validation: it validates your code before it is deployed
The tool is provider agnostic and portable. Installation is simple via pip or Docker, and it is designed to run quickly in CI. If terraform-compliance is not running quickly enough, checking the optional faster_parsing pip install flag in the Installation Guide can improve performance.
terraform-compliance allows you to apply BDD, or behavior-driven development, principles. BDD is a collaborative process where all stakeholders work together to define what a system should do. These stakeholders generally include developers, testers, and anyone with a vested interest in, or who will be impacted by, the system being developed. The goal of BDD is to encourage teams to build concrete examples that express a common understanding of how the system should behave.
Using the VM example, a compliance policy might be as follows: "If you're creating an Azure resource, it must contain a tag". The Terraform-compliance tool provides a test framework where you create policies like the example. You then run those policies against your Terraform execution plan.
The framework translates compliance rules into BDD Feature and Scenario files. A compliance-test example of creating a VM for a test environment can be translated into a BDD Feature and Scenario that expresses the expected behaviour in human-readable Gherkin syntax.
Installation and Integration
terraform-compliance can be installed from pip or run via Docker, making it portable across environments. It integrates into pipelines and git hooks to ensure all deployments are validated.
pip install terraform-compliance
docker run --rm -v $(pwd):/terraform-compliance terraformcompliance/cli
The segregation of duty model enables a separate security or compliance team to own the test repository while developers own the Terraform modules. Tests can run on every pull request before Terraform plans are approved.
Policy-as-Code Landscape for Terraform
The most widely used PaC frameworks for Terraform are Open Policy Agent, HashiCorp Sentinel, and Checkov. Each provides a different approach to scanning plans for violations.
| Framework | Type | Typical Use |
|---|---|---|
| Open Policy Agent | Policy engine | Reusable policies across services |
| HashiCorp Sentinel | HashiCorp native | Enterprise policy enforcement |
| Checkov | Static analysis | Broad IaC and cloud security scanning |
| terraform-compliance | BDD negative testing | Terraform plan validation with Gherkin |
Terraform compliance and governance is enforced through policy-as-code tools like Sentinel, OPA, or Checkov, which scan plans for violations during the CI/CD workflow.
When you reach a certain Terraform footprint in your organization, there is a clear need for compliance and governance around the use of Terraform in order to just stay in business. You don’t want to allow developers to freely roam and do as they please. This is not necessarily because you don’t trust your developers, but your organization has a reputation to uphold, and one or more governance frameworks to abide by.
Compliance Frameworks and Mapping
Through policy-as-code and scanning tools, Terraform helps enforce specific external standards. Common frameworks addressed include CIS Benchmarks, SOC 2, PCI DSS, HIPAA, NIST 800-53, ISO 27001, FedRAMP, and GDPR.
Solutions like Checkov, Sentinel, and pre-built compliant modules map specific controls to Terraform resource configurations. Terraform compliance and governance is the practice of ensuring Terraform-managed infrastructure meets external regulatory frameworks such as SOC 2, PCI-DSS, HIPAA, DORA, NIST and internal organizational rules around cost, tagging, naming, and access.
| Framework | Focus Area |
|---|---|
| CIS Benchmarks | Secure baseline configurations |
| SOC 2 | Security and availability controls |
| PCI DSS | Payment card data protection |
| HIPAA | Healthcare data privacy |
| NIST 800-53 | Federal information security |
| ISO 27001 | Information security management |
| FedRAMP | US cloud security authorization |
| GDPR | Data protection and privacy |
Mapping policies to specific compliance frameworks for audit purposes is a best practice. Maintain a library of compliance policies versioned alongside your Terraform modules and test compliance policies against known-good and known-bad configurations.
Common Challenges and Best Practices
Common Terraform compliance challenges include:
- Drift between deployed state and declared configuration
- Inconsistent enforcement across teams
- Mapping abstract framework controls to concrete resources
- Handling exceptions without permanent suppressions
- Proving continuous compliance to auditors rather than point-in-time snapshots
Best practices for integration include:
- Run compliance checks on every pull request before Terraform plans are approved
- Use hard-mandatory policies for critical security requirements and soft-mandatory for recommendations
- Maintain a library of compliance policies versioned alongside your Terraform modules
- Test compliance policies against known-good and known-bad configurations
- Map your policies to specific compliance frameworks like CIS, SOC2, or HIPAA for audit purposes
- Provide clear error messages in policy denials so developers know how to fix issues
- Start with a small set of critical policies and expand gradually to avoid overwhelming teams
Integrating compliance tools with Terraform is essential for organizations that need to meet regulatory requirements and maintain security standards. Whether you use Sentinel, OPA, Checkov, terraform-compliance, or a combination, the key is to automate compliance checks as part of your infrastructure delivery pipeline. This ensures that every infrastructure change is validated against your policies before it reaches production, reducing risk and making audit processes smoother.
Conclusion
Terraform compliance transforms infrastructure delivery from a developer-only activity into a governed, auditable process. By validating plans before apply, organizations prevent non-compliant resources from reaching production and create a consistent security posture across teams. terraform-compliance provides a lightweight, open source, provider agnostic approach rooted in behaviour-driven development and negative testing, enabling segregation of duty and pre-deploy validation.
Policy as code remains the primary mechanism for enforcement, with tools like Open Policy Agent, HashiCorp Sentinel, and Checkov complementing BDD style frameworks. Effective programs map abstract controls to concrete Terraform resources, version policies alongside modules, and automate checks in CI/CD. The result is continuous compliance rather than point-in-time audits, clearer error messages for developers, and a sustainable governance model that scales with Terraform adoption across the organization.