Best Infrastructure Policy as Code Tools in 2026
Updated
In short: Conftest is ranked #1 of 24 as of 4 October 2026, ahead of Google Cloud Terraform Policy Validation and Open Policy Agent. The best-ranked option with a free plan is Google Cloud Terraform Policy Validation. The lowest first paid tier on this page is Terraform at $0.10/mo.
Infrastructure policy tools differ in the formats and languages used to define rules, and in where those rules are checked. The ranking starts with Conftest and Google Cloud Terraform Policy Validation, followed by Kubewarden and Open Policy Agent. Compare IaC formats and policy language with CI/CD integration, admission control, and runtime enforcement to understand where checks may fit in a workflow. Policy testing and reporting provide further comparison points for validating rules and surfacing results. Terraform, Cloud Custodian, Google Config Sync, and HashiCorp Nomad also appear among the first entries. Free-plan availability and paid-from pricing add cost context. Consider which stages of your infrastructure process need policy checks.
24 infrastructure policy as code tools ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score
- 1 Conftest No phone app RecognisedPhone appDocumentedFree plan 6.4Free
- 2 Google Cloud Terraform Policy Validation No phone app RecognisedPhone appDocumentedFree plan 6.4Free Policy language: RegoIaC formats: Terraform plan JSONPolicy testing: Yes
- 3 Open Policy Agent No phone app RecognisedPhone appDocumentedFree plan 6.4Free Policy language: RegoIaC formats: Terraform plan JSON, JSON, YAMLPolicy testing: Yes
- 4 Terraform No phone app RecognisedPhone appDocumentedFree plan 6.4$0.10/mo
- 5 Cloud Custodian No phone app RecognisedPhone appDocumentedFree plan 6.3Free Policy language: YAMLIaC formats: TerraformPolicy testing: Yes
- 6 Google Config Sync No phone app RecognisedPhone appDocumentedFree plan 6.3Free Policy language: RegoIaC formats: Kubernetes YAML manifests and Custom ResourcesPolicy testing: Yes
- 7 AWS CloudFormation No phone app RecognisedPhone appDocumentedFree plan 6.2Free
- 8 cfn-lint No phone app RecognisedPhone appDocumentedFree plan 6.2Free Policy language: AWS CloudFormation Guard DSLIaC formats: CloudFormation templates and change sets; Terraform JSON; Kubernetes configurationsPolicy testing: Yes
- 9 Checkov No phone app RecognisedPhone appDocumentedFree plan 6.2Free
- 10 KICS No phone app RecognisedPhone appDocumentedFree plan 6.2Free Policy language: OPA RegoIaC formats: Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, Serverless FrameworkPolicy testing: Yes
- 11 Kyverno No phone app RecognisedPhone appDocumentedFree plan 6.2Free
- 12 Kubewarden No phone app RecognisedPhone appDocumentedFree plan 5.8 Policy language: WebAssembly-compatible languages including Rust, Go, CEL, and RegoIaC formats: Kubernetes resources and admission requests in YAML/JSONPolicy testing: Yes
- 13 Chef Infra No phone app RecognisedPhone appDocumentedFree plan 5.7$4.92/mo Policy language: Ruby DSLIaC formats: Servers, containers, cloud APIsPolicy testing: Yes
- 14 HashiCorp Nomad No phone app RecognisedPhone appDocumentedFree plan 5.7 Policy language: SentinelIaC formats: Terraform configurations, states, and plansPolicy testing: Yes
- 15 Firefly No phone app RecognisedPhone appDocumentedFree plan 5.4$2,499/mo
- 16 Terraform Test Framework No phone app RecognisedPhone appDocumentedFree plan 5.4 Policy language: PythonIaC formats: TerraformPolicy testing: Yes
- 17 terraform-compliance No phone app RecognisedPhone appDocumentedFree plan 5.4Free Policy language: BDD-style feature filesIaC formats: Terraform plan and state outputPolicy testing: Yes
- 18 Tirith No phone app RecognisedPhone appDocumentedFree plan 5.4 Policy language: JSONIaC formats: Terraform plans, CloudFormation, Kubernetes, Infracost, JSONPolicy testing: Yes
- 19 Google Cloud Organization Policy No phone app RecognisedPhone appDocumentedFree plan 5.3 Policy language: YAML and JSONPolicy testing: Yes
- 20 KubeLinter No phone app RecognisedPhone appDocumentedFree plan 5.3 Policy language: YAML configuration; CEL expressionsIaC formats: Kubernetes YAML, Helm, KustomizePolicy testing: Yes
- 21 PolicyForge No phone app RecognisedPhone appDocumentedFree plan 5.2 Policy language: OPA/RegoIaC formats: Terraform, Bicep, Kubernetes manifests, Helm charts
- 22 Fairwinds Polaris No phone app RecognisedPhone appDocumentedFree plan 5.1
- 23 Nirmata Enterprise for Kyverno No phone app RecognisedPhone appDocumentedFree plan 5.1 Policy language: Kubernetes-native YAML and CELIaC formats: Kubernetes manifests, Terraform plans, OpenTofu plans, Dockerfiles, AWS CDK, CloudFormation templates, Ansible playbooksPolicy testing: Yes
- 24 Open Policy Agent Gatekeeper No phone app RecognisedPhone appDocumentedFree plan 5.0
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which infrastructure policy as code tool is ranked first on Samsung Mobile US Press?
Conftest is ranked #1 of 24 with a score of 6.4. Google Cloud Terraform Policy Validation is second and Open Policy Agent third.
How many of these have a free plan?
12 of the 24 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Terraform has the lowest first paid tier we found: $0.10/mo.
How is this list ranked?
Ranked mobile-first: a phone app alongside the web or desktop product, a free tier and the depth of its documentation. Paid placements never change a rank.