Conftest in Argo CD: Block Public S3 Buckets at GitOps Gate

A developer pushes a Terraform module with a public S3 bucket — here's exactly how to catch and block it in your Argo CD pipeline using Conftest policy-as-code before it ever reaches production. You'll learn: How Conftest integrates with Argo CD as a pre-sync hook to enforce OPA policies on Terraform plans Writing a Rego rule that flags acl = public-read or block_public_acls = false on aws_s3_bucket resources Where in the GitOps workflow the gate fires — and why admission controllers alone aren't enough for IaC drift How to surface policy failures as Argo CD sync errors so engineers see the violation before merge, not after deploy Common gotchas: Terraform plan JSON output format, conftest namespace mismatches, and false positives on legacy modules Keywords: Conftest Argo CD policy, OPA Terraform GitOps, block public S3 bucket IaC, GitOps security controls, Rego policy Terraform plan 🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud