A Python package for defining and enforcing Policy as Code standards in Terraform configurations.
Terraform Validate is a Python package that allows teams to define and enforce Policy as Code for Terraform configurations. It parses Terraform files to validate that resources comply with organizational standards, such as encryption requirements or tagging policies. The tool integrates with testing frameworks like unittest to provide automated validation as part of infrastructure development workflows.
DevOps engineers, infrastructure teams, and security professionals who use Terraform and need to enforce compliance, security, and organizational standards across their infrastructure code.
Developers choose Terraform Validate because it provides a programmatic, test-driven approach to infrastructure validation, enabling teams to catch policy violations early in the development cycle. Its fluent API and integration with existing Python testing frameworks make it easy to adopt and extend for custom validation rules.
Assists in the enforcement of user-defined standards in Terraform
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enables method chaining for nested property validation, as demonstrated in examples like `.resources('aws_instance').property('ebs_block_device').property('encrypted').should_equal(True)`.
Seamlessly integrates with unittest framework, allowing infrastructure tests to be part of standard Python test suites, shown in the example usage with TestCase.
Supports regex matching for resource names and properties, and can expand Terraform variables with default values using `enable_variable_expansion()` function.
Provides Docker support for consistent test environments, with clear build and run commands in the README for containerized validation.
Only validates .tf files statically; it does not integrate with Terraform runtime, so it cannot catch issues that arise during plan or apply, relying solely on file parsing.
Variable expansion is restricted to default values, as admitted in the README, making it insufficient for dynamic or computed variables without defaults.
Requires Python and pyhcl, which can be a barrier for teams not already using Python in their infrastructure toolchain, adding setup complexity.