Conftest

Free#11 of 22 in Infrastructure as Code Security SoftwareInfrastructure Policy as Code ToolsInfrastructure Testing Tools

Test structured configuration data with Open Policy Agent policies.

—Not yet scored

Visit Conftest

At a glance

• Editor score
  Not yet scored
• Pricing
  Free plan
• Best for
  Teams writing Rego IaC policies
• Free plan
  Yes
• Paid from
  None
• Custom policies
  Yes
• Facts checked
  20 Sep 2026

• Where it wins

  • Flexible Rego policies with custom directories and namespaces
  • Terraform and Kubernetes testing across Windows, macOS, and Linux
  • Pull-request, pre-commit, container, and multiple report-format support

• Where it doesn't

  • No verified secrets detection
  • No CloudFormation analysis
  • CLI utility rather than a hosted SaaS product

Our verdict on Conftest

Conftest is an open-source command-line utility for testing structured configuration data with policies written in Open Policy Agent Rego. It is aimed at teams that want to define and run custom checks against Terraform code, Kubernetes configurations, Tekton pipeline definitions, Serverless configurations, and other structured files. The tool runs on Windows, macOS, and Linux, and can be distributed as a Docker image, giving policy authors local and container-based workflows without a hosted product model.

Its main strength is policy flexibility. Custom policy directories and namespaces let teams organize their Rego rules, while plugins extend the CLI beyond its core behavior. Conftest also fits common development workflows through GitHub Actions pull-request checks and pre-commit hooks. Output is available in JSON, JUnit, GitHub, Azure DevOps, and SARIF formats, which supports both local review and integration with development or reporting systems. Teams already working with Rego and Open Policy Agent will find the broad configuration-policy surface more relevant than a narrowly packaged Terraform scanner.

Conftest is free and open source, with no paid tier structure to compare. Its focus is policy evaluation rather than a wider hosted security platform: the published capabilities cover Terraform and Kubernetes analysis, but not verified secrets detection or CloudFormation analysis. Teams that need portable, code-defined checks and control over their policy namespaces should consider Conftest. Teams seeking managed onboarding, a hosted interface, verified secrets detection, or CloudFormation coverage should choose a product built around those requirements instead.

Conftest pricing

Conftest fact sheet

Conftest integrations

Conftest lists 3 integrations on its own site.

• GitHub Actions
• pre-commit
• Docker

Alternatives to Conftest

• KICSA broad, free IaC scanner for security, compliance, secrets, and misconfigurations.—
• CheckovA free, multi-framework IaC scanner with custom policies, graph analysis, and CI/CD support.—
• Snyk IaCA broad IaC security layer for teams that need scanning, governance, and drift management.8.4

See all Conftest alternatives →

Also listed in

• Infrastructure Policy as Code Tools
• Infrastructure Testing Tools

Used Conftest? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Conftest for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · your e-mail is never shown · read by an editor before it appears

Website

Your rating

5 stars★4 stars★3 stars★2 stars★1 star★

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name

E-mail (to confirm your review · never shown)

Role (optional)

Company (optional)

How long have you used it?Prefer not to sayLess than a month1–6 months6–12 months1–2 years2+ years

I've used Conftest myself and this is my honest opinion — nobody paid or asked me to write it.

Send my reviewYou'll get a confirmation link by e-mail. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Reviewed by iTechGuides Editors · Editorial team · Updated Sep 2026

Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. It never changes a score or a verdict. How we rank.