Conftest review
A free, flexible Rego CLI for Terraform and Kubernetes policy checks.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Conftest is an open-source command-line utility for testing structured configuration data with policies written in Open Policy Agent Rego. It is aimed at teams that want to define and run custom checks against Terraform code, Kubernetes configurations, Tekton pipeline definitions, Serverless configurations, and other structured files. The tool runs on Windows, macOS, and Linux, and can be distributed as a Docker image, giving policy authors local and container-based workflows without a hosted product model.
Its main strength is policy flexibility. Custom policy directories and namespaces let teams organize their Rego rules, while plugins extend the CLI beyond its core behavior. Conftest also fits common development workflows through GitHub Actions pull-request checks and pre-commit hooks. Output is available in JSON, JUnit, GitHub, Azure DevOps, and SARIF formats, which supports both local review and integration with development or reporting systems. Teams already working with Rego and Open Policy Agent will find the broad configuration-policy surface more relevant than a narrowly packaged Terraform scanner.
Conftest is free and open source, with no paid tier structure to compare. Its focus is policy evaluation rather than a wider hosted security platform: the published capabilities cover Terraform and Kubernetes analysis, but not verified secrets detection or CloudFormation analysis. Teams that need portable, code-defined checks and control over their policy namespaces should consider Conftest. Teams seeking managed onboarding, a hosted interface, verified secrets detection, or CloudFormation coverage should choose a product built around those requirements instead.
Conftest pros and cons
- Where it wins
- Flexible Rego policies with custom directories and namespaces
- Terraform and Kubernetes testing across Windows, macOS, and Linux
- Pull-request, pre-commit, container, and multiple report-format support
- Where it doesn't
- No verified secrets detection
- No CloudFormation analysis
- CLI utility rather than a hosted SaaS product
Conftest fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update