This is the most basic way to use OPA policies with Digger. For more advanced use cases check out OPA policies

You can configure Digger CLI to run Conftest ito check your Terraform plan output against Open Policy Agent policies.

​
Pre-requisites

  • Conftest binary needs to be installed into your CI pipeline (see Conftest Docs)

  • OPA policies (rego files) under /policies directory in your repo

​
Digger.yml configuration

Example assumes the terraform is in the prod directory.

Don’t forget to update the json file name as well if your directory is named differently

projects:
- name: prod
  dir: prod
  workflow: my_custom_workflow
workflows:
  my_custom_workflow:
    plan:
      steps:
      - init:
      - plan
      - run: "conftest test ./prod.json -p ../policies"
    workflow_configuration:
      on_pull_request_pushed: [digger plan]
      on_pull_request_closed: [digger unlock]
      on_commit_to_default: [digger apply]