What are the advantages of conftest compared to OPA ?

[rrey]

Hello,

I saw that OPA was in the inspiration list and I am currently looking for tools that would help me test my terraform code.

I didn't try both tools a lot for the moment, but what would you think would be an advantage of contest compared to using open policy agent ?

Both seems very close in term of features for my use case.

Thanks

[garethr]

Hi @rrey.

Actually, Conftest uses OPA under the hood. OPA is doing most of the work, and the Rego language used in Conftest is part of OPA. What Conftest does is provide a simple CLI user interface, that makes it easier to jump in with OPA locally or in a CI environment. OPA is mainly used either as a library like this, or as an independent server.

So which you use depends on your usecase.

Note that OPA tests structured data, which generally means JSON or YAML. It's possible to convert HCP (from Terraform) into JSON (eg. with https://www.hcl2json.com/ or https://github.com/kvz/json2hcl) and you could then write rego tests against the HCL code. I have an issue open to track interest or find folks who want to add HCL as a supported input to Conftest #3 too.

If you are using 0.12 and want to test the plan format, you can find an example here as well https://github.com/instrumenta/conftest/tree/master/examples/terraform

[rrey]

Thanks for the quick answer !