Terraform Code Reviews: Supercharged with Conftest
summary
Shows using Conftest + Rego to run Terraform plan JSON checks inside Atlantis CI so policies run as part of PRs, set per-policy GitHub status, and block merges when violated. Recipes include a resource whitelist, a module whitelist that rewards approved module use, and a rule to reject >10 deletions. Implementation uses Atlantis plan→terraform show JSON→Conftest check, updates GitHub status, ties into PullApprove; deployed at DoorDash and cuts manual PR approvals.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 2:05Terraform evolution overview
- 7:41Works on my machine era
- 11:40Looks good to me era
- 12:23Automating with Conftest
- 15:16Policy enforcement basics
- 18:47Quick policy recipes
- 22:19Demo setup and workflow
- 26:16Live policy enforcement demo
- 29:45Pros, cons and summary
related talks
15mTerraform Practices: The Good, the Bad, and the Ugly
06mProject Lightning Talk: Atlantis: Terraform Pull Request Automation for Cloud Native Teams
41mTerraform Practices - The Good, the Bad, and the Ugly
45mCatching Commits to Secure Infrastructure as Code
35mSelf-service PR-based automated Terraform
29mTerraform Practices - The Good, the Bad, and the Ugly
35mTerraform Practices - The Good, the Bad and the Ugly
30mTerraform Practices to Enable Infrastructure Scaling