conftest VS inspec

name: tf-plan-apply on: pull_request: branches: [ main ] env: TF_VERSION: 1.0.0 CONFTEST_VERSION: 0.28.3 WORKING_DIR: ./ jobs: terraform: name: aws-eureka-pairs-etc-s3 runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 - name: Install conftest run: | wget -O - 'https://github.com/open-policy-agent/conftest/releases/download/v${{ env.CONFTEST_VERSION }}/conftest_${{ env.CONFTEST_VERSION }}_Linux_x86_64.tar.gz' | tar zxvf - ./conftest --version //❶ - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: terraform_wrapper: false //❷ terraform_version: ${{ env.TF_VERSION }} cli_config_credentials_token: ${{ secrets.YOUR_CRED_NAME}} - name: Terraform Init ${{ env.WORKING_DIR }} working-directory: ${{ env.WORKING_DIR }} run: terraform init - name: Terraform Plan ${{ env.WORKING_DIR }} if: github.event_name == 'pull_request' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} working-directory: ${{ env.WORKING_DIR }} id: plan run: terraform plan -out=tfplan -no-color -lock=false -parallelism=50 - name: Convert terraform plan result to json formmat if: github.event_name == 'pull_request' id: convert working-directory: ${{ env.WORKING_DIR }} run: terraform show -json tfplan > tfplan.json - name: conftest test if: github.event_name == 'pull_request' id: conftest run: ./conftest test --no-color ${{ env.WORKING_DIR }}/tfplan.json //❸

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

Insert Conftest! As they state in their GitHub description, Conftest tests against structured configuration data using the Open Policy Agent Rego query language. In the case of Terraform, this means we're actually running unit tests against sample JSON and actual tests against the Terraform state JSON.

If you like terraform-compliance, Conftest might also be worth having a look. It has its own DSL to write policies, and allows you to test multiple frameworks. We found this blog post from Lennard Eijsackers very informative, and would thus rather recommend you to check it out.

Can Gatekeeper and Conftest single-source the same set of rules? I'm looking at https://github.com/open-policy-agent/conftest/issues/54#issuecomment-528988831 and not seeing how.

The course uses Chef Inspec, an open source Ruby DSL. I made a POC with this tool to automatically check repositories on GitHub, checks like if it contains a gitignore consistent with the language used, if node_modules is not present, etc.

https://github.com/inspec/inspec Chef Inspec is probably a great tool for what you’re trying to do. Great at building human readable test cases for validation of infrastructure deployments. At a different org I used to use PoSh, Terraform and Ansible etc. for deploying on-prem and cloud infrastructure and then Inspec for testing for successful deployments, security misconfigurations (is a port open that shouldn’t be etc).

I gave it a read and nothing really stood out as being unreasonable unless you can point to specifics. Inspec is open source.

You can use something like inspec to do this.

If you need the monitoring for compliance reason, Chef InSpec was designed for this exact usecase.

Before we dive into own cloud provider compliance checking services, we want to highlight yet another open source tool, namely InSpec. It allows you to write tests in ruby, and was built on top of RSpec. If you know already awsspec, then this should feel very similar, with the advantage that InSpec also supports GCP and Azure.