Terraform Compliance (InSpec) Generator

Compliance as code keeps audits repeatable, reviewable and continuous. The InSpec Generator writes a single InSpec control that targets a resource under test and asserts a condition, so you can verify Terraform-managed infrastructure the same way on every run instead of relying on manual checks. InSpec is an open-source framework from Chef in which you describe the desired state of infrastructure in Ruby and a runner verifies it against live resources.

Pick the resource under test, supply its constructor arguments, choose a check (exist, tagged, encrypted or property) and set an impact score from 0.1 to 1.0. The output is valid Ruby ready to drop into a profile and run with inspec exec against AWS, Azure or GCP. Because the control is generated from a form, you avoid typos in control syntax and keep a consistent structure across many controls. InSpec controls are self-documenting: the title and description fields appear in HTML and JSON reports, so auditors see intent and result together.

Input is validated and errors are reported inline, for example when the control id contains spaces or the resource name is not lowercase. Everything runs locally with nothing uploaded, so credentials and resource names never leave the browser. Generated controls plug straight into an InSpec profile folder, which you can version in Git and execute in CI so compliance is checked on every change rather than once a quarter.

Pair this generator with the Terraform plan output to confirm that new resources meet your tagging, encryption and existence rules before they are applied. The Markdown export also makes it easy to attach the control to a pull request or a wiki page for review, keeping the policy close to the infrastructure code it guards.

• InSpec Ruby - emits a valid control block with correct indentation.
• Four checks - exist, tagged, encrypted and property assertions.
• Any resource - aws_ec2_instance, azurerm_resource_group, google_storage_bucket and any InSpec resource.
• Constructor args - pass id, name or key values into the resource call.
• Impact scoring - a number from 0.1 to 1.0 describing severity.
• Title and description - human-readable metadata on every control.
• Self-documenting - title and desc surface in InSpec reports.
• Live stats - a count of generated Ruby lines.
• Validation - control id and resource names are checked before building.
• Profile ready - output drops into a controls directory without edits.
• CI friendly - run the same control on every pipeline for drift detection.
• Copy as Markdown - also export a fenced Markdown snippet.
• Copy / Download / Print - get control.rb wherever you need it.

1. Title and id the control - the id may use letters, digits, hyphen and underscore only.
2. Describe the resource under test and its constructor arguments.
3. Choose a check - exist, tagged, encrypted or property.
4. Set the property name when using the property check.
5. Set an impact between 0.1 and 1.0.
6. Generate the InSpec control.
7. Copy, copy as Markdown or download the result.
8. Drop it into a profile and run inspec exec.
9. Version the control in Git alongside the Terraform it guards.
10. Run in CI - call inspec exec with the profile so the gate is automatic.
11. Review in Markdown when attaching it to a pull request.

Example 1 - instance exists. aws_ec2_instance with instance_id, check exist, impact 0.5.

Example 2 - bucket tagged. aws_s3_bucket, check tagged, impact 0.7 to confirm required tags.

Example 3 - disk encrypted. azurerm_managed_disk, check encrypted, impact 0.9 for a security control.

Example 4 - property set. google_compute_instance, check property on labels, impact 0.4.

Example 5 - with description. add a description so the control reads clearly in HTML reports.

Example 6 - encryption severity. azurerm_managed_disk encrypted at impact 0.9 fails a pipeline loudly.

Example 7 - profile layout. save the control as controls/instance-tagged.rb inside an InSpec profile.

• Valid Ruby - runs under inspec exec without edits.
• Consistent - same structure across all controls.
• Flexible - any resource and any of four checks.
• Validated input - clear error messages before generation.
• Markdown export - paste into docs and runbooks.
• CI integration - catch drift before it reaches production.
• Reviewable - controls live in version control with the code.
• Auditable - reports prove controls passed at a point in time.
• Private - nothing leaves the browser.
• Portable - copy, download or print the control.