terraform-compliance vs TFLint
terraform-compliance
terraform-compliance.comTFLint
github.comSide by side
| Figure | terraform-compliance | TFLint |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · IaC Security Scanners | 7.2 (#11) | 7.3 (#10) |
| Spec score · Infrastructure Testing Tools | 7.2 (#20) | 7.2 (#22) |
| License | The maker’s site says the project is open source, free to use, and distributed under the MIT license. | The project says most of its files use MPL 2.0, some files in the terraform package use BUSL 1.1, and release binaries are bound by both licenses. |
| Purpose | terraform-compliance is a lightweight, security- and compliance-focused test framework for negative testing of infrastructure as code written with Terraform. | TFLint is a pluggable Terraform linter whose features are provided by plugins. |
Plans
In their own words
terraform-compliance
terraform-compliance is a free, open-source framework for security and compliance testing of Terraform infrastructure as code. It checks Terraform plan or state output against policies written as behavior-driven feature files, and it can read plan output converted to JSON. Given steps establish context, When steps filter it, and Then steps fail scenarios when conditions are unmet. The project says it works with any Terraform provider and supports Terraform versions newer than 0.12. Checks can run before deployment, in pipelines, or through git hooks. Feature files may come from a local directory or Git repository, with SSH authentication for private repositories. Installation is documented through pip, requiring Python 3.x, or Docker. CI/CD examples cover CircleCI and GitHub Actions. Controls include warning-only failures, skipped-step failures, case-sensitive matching, and resource exclusion. The tool supports policy testing, admission control, and policy reporting, but not runtime enforcement. Its MIT license permits free use.
TFLint
TFLint is a local command-line linter for Terraform, with checks supplied by plugins. Its bundled language rules can flag deprecated syntax and unused declarations, while cloud-specific checks look for potential errors in AWS, Azure and GCP configurations, including invalid instance types. It can also enforce best practices and naming conventions. Extend it with plugins, create your own, or write policies in Rego. An optional `--fix` flag can correct issues automatically, and reports can be emitted in default, JSON, Checkstyle, JUnit, compact or SARIF formats. TFLint runs on Linux, macOS and Windows and is free, with no free trial. The project provides a GitHub Action and Docker image; installation options include Homebrew, WinGet and Go. Most files use MPL 2.0, some files in the Terraform package use BUSL 1.1, and release binaries are bound by both licenses. The project recommends verifying release checksums with GitHub CLI artifact attestations and identifies Cosign signatures as deprecated.