regula run: Rego Policy Checks for Terraform
regula run evaluates Rego rules against Terraform (HCL or plan JSON) and CloudFormation, reporting PASS/FAIL per rule and exiting non-zero on failures above a severity.
Regula brings the Rego policy model to infrastructure-as-code. It ships a library of rules and lets you add your own, then checks Terraform in a PR before the plan is ever applied.
What it does
regula run takes Terraform source or a plan JSON, converts it to a normalized input, and evaluates Rego rules (bundled plus any you pass) against it. It prints a report of rule results with severities and, by default, exits non-zero when any rule fails at or above the configured severity.
Common usage
# run bundled rules against a Terraform directory
regula run ./terraform
# evaluate a plan JSON with custom rules and JSON output
terraform show -json plan.tfplan > plan.json
regula run --input-type tf-plan plan.json \
--include ./custom-rules --format json
# only fail on High and above
regula run ./terraform --severity highOptions
| Flag | What it does |
|---|---|
| -t, --input-type <type> | auto, tf, tf-plan, cfn (Terraform, plan JSON, CloudFormation) |
| -i, --include <path> | Additional Rego rules directory; repeatable |
| --severity <level> | Minimum severity that causes a non-zero exit |
| -f, --format <fmt> | Output: text, json, table, junit, sarif, tap |
| --no-built-ins | Do not load the bundled rule library |
| -e, --exclude <id> | Exclude specific rule ids |
In CI
Run regula run on the Terraform directory (or on a plan JSON for the most accurate results) as a PR gate before terraform apply. Use --severity to tune how strict the gate is, and --format sarif to feed findings into code scanning. Rules are pure Rego, so the check is fully offline.
Common errors in CI
Failing rules show in the report as "FAIL" rows with the rule id, resource, and severity, and the process exits non-zero when any meets --severity. "no inputs found" means the path had no recognized IaC; check --input-type. "rego_parse_error" comes from a custom rule under --include, not the Terraform. A tf-plan run needs valid plan JSON from terraform show -json, not the binary plan file.
Using this in CI
A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods
# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info
# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes