Google Cloud Terraform Policy Validation vs Open Policy Agent

Google Cloud Terraform Policy Validation checks Terraform plans against organizational security and governance constraints before infrastructure changes are applied. The `gcloud beta terraform vet` command evaluates Terraform plan JSON, retrieving project data through Google Cloud APIs. It can flag violations, issue warnings, or halt a deployment before production; it returns exit code 0 when no violations are found and 2 when they are. Platform teams can place validation between plan and apply in CI/CD workflows using Cloud Build, Jenkins, or GitHub Actions. The command accepts Terraform 0.12 or later plan JSON and requires a policy library and the Google Cloud CLI `terraform-tools` component. Policies can cover supported resources from Terraform's google and google-beta providers, and constraints can be reused with other tools that support the framework. The command is free and client-side. The feature is in Preview under Pre-GA terms, where support may be limited. Security Command Center IaC validation has separate requirements: Premium or Enterprise activation at the organization level and a specified role. That workflow also requires Terraform Google provider version 5.5 or later.

Open Policy Agent (OPA) is a free, open-source policy engine that separates policy decisions from the systems that enforce them. It evaluates policies against structured input and can return structured data, making it applicable to microservices, Kubernetes, CI/CD pipelines, and API gateways. Policies use Rego, a declarative language for complex hierarchical data. Applications can request evaluations through a REST API, Go API, WebAssembly runtimes, or custom evaluators using OPA's intermediate representation. Bundles distribute policy and data to OPA instances, while discovery bundles carry configuration. Management interfaces support policy distribution, health and status checks, and decision logs. Listed integrations include Kubernetes, Terraform, Envoy, and code editors; the documentation recommends OPA Gatekeeper for Kubernetes admission control. Installation options cover macOS, Linux/Unix, Windows, and Docker. OPA's security guidance says API authentication and authorization are off by default and recommends configuring TLS, authentication, and authorization when securing the API. OPA is a graduated Cloud Native Computing Foundation project.