terraform-compliance

What it is and what it does

terraform-compliance is a test framework that applies Behaviour Driven Development principles to infrastructure-as-code validation. Instead of traditional functional testing, it focuses on negative testing—ensuring your Terraform code adheres to security and compliance policies before deployment. You write policies in plain Gherkin syntax (the same language used in radish-bdd), which makes them readable to both developers and security teams. The framework parses your Terraform plan and validates it against these policies, catching violations early in your CI/CD pipeline.

The package depends on radish-bdd for feature file parsing, gitpython for repository operations, and several utilities for parsing, formatting, and caching results. It runs on multiple Python versions and operating systems, integrating easily into existing deployment pipelines or git hooks. The framework is particularly useful when you need to enforce organizational standards—such as requiring S3 bucket encryption or preventing public security group rules—without relying on enterprise Sentinel licensing.

Use it for:

• Enforce encryption requirements on cloud storage resources before they are deployed to production.
• Validate that security groups and network ACLs follow your organization's least-privilege policies.
• Ensure all database instances have backup and high-availability configurations defined in code.
• Prevent creation of publicly accessible resources that should remain private.
• Run compliance checks in CI/CD pipelines to gate infrastructure deployments.
• Segregate policy ownership by storing feature files in a separate repository managed by a security team.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

terraform-compliance is a BDD-based test framework that validates Terraform infrastructure code against security and compliance policies before deployment, using human-readable Gherkin syntax to define and enforce infrastructure standards.

Yes. terraform-compliance is actively maintained, has no known vulnerabilities, low install friction, and fills a genuine gap in open-source infrastructure policy testing. It is worth installing if you need to enforce compliance or security standards on Terraform code before deployment, especially in teams where policy ownership should be separated from development.

Install

terraform-compliance on PyPI

pip install terraform-compliance

uv add terraform-compliance

poetry add terraform-compliance

Installing terraform-compliance

Before you install

Low install friction with a pure-Python wheel and 13 runtime dependencies. Actively maintained with recent commits and a stable release cadence; last release 98 days ago.

License in practice

MIT license permits free use, modification, and distribution with minimal restrictions, making it suitable for both open-source and commercial infrastructure projects.

Quickstart

pip install terraform-compliance

Create a .feature file with Gherkin syntax:
  Given I have AWS S3 Bucket defined
  Then it must contain server_side_encryption_configuration

Run against a Terraform plan:
  terraform-compliance -p tfplan.json -f features/

Requires a Terraform plan in JSON format (terraform plan -out=tfplan && terraform show -json tfplan > tfplan.json); Gherkin feature files must follow radish syntax conventions.

Verify before relying

• Whether the optional faster_parsing pip install flag is available and what performance improvement it provides.
• Specific Terraform versions supported or tested against.
• Whether custom policy libraries or pre-built policy packs are available beyond the core framework.

Package facts

Evidence: terraform_compliance-1.15.1-py2.py3-none-any.whl

Tags

More Python Modules packages