Implementing Unit Tests for Terraform with Open Policy Agent
summary
Shows how to run Open Policy Agent with Rego against Terraform plan JSON (uses parse-terraform-plan npm to convert HCL to JSON) to compute weighted scores for create/modify/delete operations and gate CI/CD actions. Builds a Rego policy that sums weights, blast radius <30 auto-approve, and explicitly deny changes to network security groups. OPA runs as local binary or daemon in pipeline; demo conversion and evaluation is shown (demo run fails but policy approach and CI integration work).
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:37Why Unit Testing
- 1:46Open Policy Agent
- 3:17What is OPA
- 4:45OPA Implementation
- 6:50Rego Demo
- 7:45Use Cases
- 8:40Demo
- 15:05Summary
- 16:06References
related talks
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
36mOpen Policy Agent: security for cloud natives and everyone else
39mOPA
29mOpen Policy Agent (OPA) Intro & Deep Dive
32mOPA: So What Does the Policy Do?
25mPolicy-as-Code for Infrastructure-as-Code with OPA and OpenTofu
41mTaking Command of Cloud Security with OPA