c7n-left vs Conftest
c7n-left
cloudcustodian.ioConftest
conftest.devSide by side
| Figure | c7n-left | Conftest |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 0 | 1 |
| Spec score · Infrastructure as Code Security Software | 7.7 (#17) | 8.4 (#7) |
| CI integration | Its GitHub output mode reports annotations directly into pull requests. | The project documents integrations with CircleCI, GitHub Actions and Tekton Pipelines. |
| Policy language | Policies support standard Custodian filters, multiple resource types, taggable-resource filtering, and multi-hop resource graph traversal. | Conftest uses the Open Policy Agent Rego language for writing policies. |
| Policy testing | c7n-left supports tests that match policy findings against assertions in plan files. | The `conftest verify` command executes policy unit tests and reports their results. |
| Purpose | c7n-left evaluates Cloud Custodian policies directly against infrastructure-as-code source assets. | Conftest is a utility for writing tests against structured configuration data. |
Plans
In their own words
c7n-left
c7n-left has no write-up on Specifiction yet; its figures are above.
Conftest
Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.