One of the key tenets of infrastructure as code (IaC) is automated testing. If we have a solid test pyramid with good code-level coverage at the bottom, we can produce a better and more secure infrastructure. Unfortunately, tools to assist in this space have been sparse. Conftest is frequently used to test Terraform JSON and HCL code, but it is a general-purpose tool. Regula is an attractive alternative. Similar to Conftest, Regula checks for compliance of infrastructure code by applying rules written in Open Policy Agent's Rego language, but it also provides a set of primitives specifically for validating infrastructure configurations. Because both tools are based on the Rego language, Regula rules can be run by Conftest. However, Regula comes with its own command-line tool for running tests as part of a pipeline with no dependence on Conftest or OPA. Our developers have found that Regula saves time and produces much more readable, maintainable and succinct test code. Still, both tools only validate the infrastructure code. A complete suite should also test the infrastructure to ensure the code is being accurately interpreted.
