regula run: Rego Policy Checks for Terraform
regula run evaluates Rego rules against Terraform (HCL or plan JSON) and CloudFormation, reporting PASS/FAIL per rule and exiting non-zero on failures above a severity.
Regula brings the Rego policy model to infrastructure-as-code. It ships a library of rules and lets you add your own, then checks Terraform in a PR before the plan is ever applied.
What it does
regula run takes Terraform source or a plan JSON, converts it to a normalized input, and evaluates Rego rules (bundled plus any you pass) against it. It prints a report of rule results with severities and, by default, exits non-zero when any rule fails at or above the configured severity.
Common usage
# run bundled rules against a Terraform directory
regula run ./terraform
# evaluate a plan JSON with custom rules and JSON output
terraform show -json plan.tfplan > plan.json
regula run --input-type tf-plan plan.json \
--include ./custom-rules --format json
# only fail on High and above
regula run ./terraform --severity highOptions
| Flag | What it does |
|---|---|
| -t, --input-type <type> | auto, tf, tf-plan, cfn (Terraform, plan JSON, CloudFormation) |
| -i, --include <path> | Additional Rego rules directory; repeatable |
| --severity <level> | Minimum severity that causes a non-zero exit |
| -f, --format <fmt> | Output: text, json, table, junit, sarif, tap |
| --no-built-ins | Do not load the bundled rule library |
| -e, --exclude <id> | Exclude specific rule ids |
In CI
Run regula run on the Terraform directory (or on a plan JSON for the most accurate results) as a PR gate before terraform apply. Use --severity to tune how strict the gate is, and --format sarif to feed findings into code scanning. Rules are pure Rego, so the check is fully offline.
Common errors in CI
Failing rules show in the report as "FAIL" rows with the rule id, resource, and severity, and the process exits non-zero when any meets --severity. "no inputs found" means the path had no recognized IaC; check --input-type. "rego_parse_error" comes from a custom rule under --include, not the Terraform. A tf-plan run needs valid plan JSON from terraform show -json, not the binary plan file.