// the take
terraform-compliance is a BDD-style negative-testing tool: you write Gherkin feature files describing what a config must NOT do (e.g. an S3 bucket without encryption), and it checks them against your `terraform plan` JSON output before anything gets applied. It's aimed at platform/security teams who want Sentinel-style policy guardrails on open-source Terraform, wired into CI or a pre-commit hook rather than Terraform Enterprise.
Policies are plain Gherkin checked straight against `terraform show -json` plan output, so security and engineering read/write the same artifact and nothing needs to actually apply to be validated. It needs no Terraform provider, wrapper binary, or Enterprise license — pip install or Docker, drop into an existing pipeline or git hook. The functional test suite covers real edge cases (nested modules, for_each/count, module-level actions) rather than just toy single-resource configs, which is where most plan-JSON parsers break first. It's a genuinely free alternative to Sentinel for teams that can't justify Enterprise just for policy checks.
It parses the Gherkin layer through radish, a much less mainstream BDD engine than pytest-bdd or behave, so compatibility issues and bugs show up here first and fixes depend on an upstream project most users have never touched. Unlike Checkov or tfsec, it ships no bundled policy library — every control (encryption, tagging, security groups) has to be written and maintained by you from the docs/examples, so adoption cost scales with however many rules your org needs. It's tightly coupled to the terraform plan JSON schema, and a major Terraform version bump or a move to OpenTofu can silently shift resource attribute paths and break existing feature files with no schema-version check to catch it. The step vocabulary is large and quite specific (it_must_be_in, it_must_not_be_in, it_must_cover, it_must_not_cover, its_key_condition_be_value...), so writing anything beyond the canned examples means learning a sizeable DSL rather than a small general matcher language.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →