World map

 

BM

World T4: Modules & Pipelines

Policy checks

You will learn: how a written rule checks every plan, and stops the risky ones before review.

Checked with OpenTofu 1.13 on 1 Nov 2026

The problem

A robot reads every plan before a human does. Swipe: let it through (good), or stop it (needs work)?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

The plan adds one kiosk

Watch

Tap the line that looks for things being destroyed.

0 of 1 found

A policy check: A written rule a robot checks on every plan, like: nothing may destroy the database. is a written rule a robot checks on every plan. This one is Rego, the rule language of Open Policy Agent.

Try it

Put the policy steps in order.

First at the top. Put these in order. Use the arrows, or drag.

  • tofu show -json tfplan > plan.json
  • conftest test plan.json
  • A red check stops the merge until someone looks
  • tofu plan -out tfplan

Predict

The plan replaces the stall (-/+). It does not plainly destroy it. Does the rule catch it?

Watch

bash
conftest test plan.json
FAIL - plan.json - main - random_pet.stall would be destroyed
FAIL - plan.json - main - terraform_data.fridge would be destroyed
2 tests, 0 passed, 0 warnings, 2 failures, 0 exceptions

A real run, Conftest 0.71. The stall was replaced, the fridge removed. Both are caught, so the check turns red.

Check

What should a robot rule check, and what needs a human?

Drag a card into a box. Or tap the card, then tap the box.

      You did it!

      You can now read a policy rule and put it in the pipeline.

      Go deeper (optional)

      Other tools: Checkov and Trivy scan .tf files for risky settings. HCP Terraform can run Sentinel or OPA policies. Inside OpenTofu, variable validation and check blocks are rules too. Tip: start new rules as warnings, then make them errors.

      Real mission

      1. tofu plan -out tfplan
      2. tofu show -json tfplan > plan.json
      4. docker run --rm -v "$PWD:/project" -w /project openpolicyagent/conftest:v0.71.1 test plan.json

      0 of 4 steps done · Your ticks are saved.