Conftest
Conftest: A free, flexible Rego CLI for Terraform and Kubernetes policy checks. Ranked #11 of 22 in Infrastructure as Code Security Software by our editors (8.3/10); pricing: Free plan; best for teams writing Rego IaC policies.
At a glance
- Editor score8.3 / 10
- PricingFree plan
- Best forTeams writing Rego IaC policies
- Free planYes
- Paid fromFree
- Custom policiesYes
- Facts checked20 Sep 2026
Where it wins
- Flexible Rego policies with custom directories and namespaces
- Terraform and Kubernetes testing across Windows, macOS, and Linux
- Pull-request, pre-commit, container, and multiple report-format support
Where it doesn't
- No verified secrets detection
- No CloudFormation analysis
- CLI utility rather than a hosted SaaS product
Our verdict on Conftest
Conftest is an open-source command-line utility for testing structured configuration data with policies written in Open Policy Agent Rego. It is aimed at teams that want to define and run custom checks against Terraform code, Kubernetes configurations, Tekton pipeline definitions, Serverless configurations, and other structured files. The tool runs on Windows, macOS, and Linux, and can be distributed as a Docker image, giving policy authors local and container-based workflows without a hosted product model.
Its main strength is policy flexibility. Custom policy directories and namespaces let teams organize their Rego rules, while plugins extend the CLI beyond its core behavior. Conftest also fits common development workflows through GitHub Actions pull-request checks and pre-commit hooks. Output is available in JSON, JUnit, GitHub, Azure DevOps, and SARIF formats, which supports both local review and integration with development or reporting systems. Teams already working with Rego and Open Policy Agent will find the broad configuration-policy surface more relevant than a narrowly packaged Terraform scanner.
Conftest is free and open source, with no paid tier structure to compare. Its focus is policy evaluation rather than a wider hosted security platform: the published capabilities cover Terraform and Kubernetes analysis, but not verified secrets detection or CloudFormation analysis. Teams that need portable, code-defined checks and control over their policy namespaces should consider Conftest. Teams seeking managed onboarding, a hosted interface, verified secrets detection, or CloudFormation coverage should choose a product built around those requirements instead.
Your product? Our editors can test Conftest in depth and publish a review, labelled as paid · from $149/mo →
Conftest pricing
Conftest fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Terraform analysis | Yes |
| Kubernetes analysis | Yes |
| CloudFormation analysis | Not verified |
| Custom policies | Yes |
| Secrets detection | Not verified |
| Pull request scanning | Yes |
| IDE integration | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 3 integrations: GitHub Actions, pre-commit, Docker |
| Pricing | Free plan |
| Website | conftest.dev |
| Facts checked | 20 Sep 2026 |
Conftest integrations
Conftest lists 3 integrations on its own site.
- GitHub Actions
- pre-commit
- Docker
Alternatives to Conftest
- KICSA broad, free IaC scanner for security, compliance, secrets, and misconfigurations.9.4
- CheckovA free, multi-framework IaC scanner with custom policies, graph analysis, and CI/CD support.9.3
- Snyk IaCA broad IaC security layer for teams that need scanning, governance, and drift management.9.1
See all Conftest alternatives →
Also Ranked In
Conftest is ranked in 3 of our directories.
Used Conftest? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Conftest for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Conftest is listed in our Infrastructure as Code Security Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/conftest/"><img src="https://www.itechguides.com/best/badge/conftest.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update