Familiar CEL authoring
Write policies in the same expression language Kubernetes standardized on, without forcing platform teams into Rego.
Early alpha Terraform + OpenTofu CEL
CEL-based policy engine for Terraform and OpenTofu plans
Norn evaluates policies locally against plan JSON, with no server, no Rego, and honest handling for values known only after apply.
- Compile policies once, evaluate plan changes locally.
- Return pass, fail, unknown, or error with enforcement-aware outcomes.
- Fit naturally into pull requests and CI/CD.
Example policy
apiVersion: norn.idunn.cloud/v1alpha1
kind: PolicySet
policies:
- id: az-nsg-no-public-admin-ports
severity: high
enforcement: mandatory
match:
types: [azurerm_network_security_rule]
expression: >
!(after.access == "Allow" && after.direction == "Inbound"
&& after.destination_port_range == "22"
&& after.source_address_prefix in ["*", "0.0.0.0/0", "Internet"])
message: SSH must not be open to the internetCurrent release
v0.1.0-alpha.1
Status
Usable for early adopters. Policy surface and helpers may still change before `v1.0.0`.
Current focus
Azure-first today. Terraform and OpenTofu plan JSON supported.
Why Norn
A simpler path than Rego-heavy Terraform policy stacks
Norn is built for teams who want strong plan-time policy checks without sending engineers down a rabbit hole of opaque plan parsing and a second full policy language.
Honest unknown handling
Map Terraform after_unknown values into CEL partial evaluation so Norn can report pass, fail, or genuinely undecidable.
Runs anywhere
Evaluate terraform show -json or tofu show -json output locally in CI/CD with no server dependency.
Real enforcement levels
Use advisory, overridable, and mandatory policies so teams can roll out guardrails without all-or-nothing blocking.
Who it’s for
Built for early adopters who want practical plan-time guardrails
Norn is intentionally opinionated in its current alpha shape. It is a strong fit for some teams today, and not yet the right choice for every policy workflow.
Good fit today
- Platform engineers who want plan-time policy checks without adopting Rego.
- Terraform and OpenTofu teams that prefer simple CEL expressions over a larger policy language.
- Azure-focused teams evaluating early policy guardrails today.
- Teams that care about honest handling for values that remain unknown until apply.
Probably not the best fit yet
- Teams that need mature exception workflows and centralized policy administration right now.
- Organizations expecting broad AWS and GCP policy packs on day one.
- Buyers looking for a hosted SaaS product, UI, or enterprise control plane today.
- Teams that cannot tolerate alpha-stage changes to policy helpers or output shape.
Quickstart
From zero to blocked plan in a few commands
Today Norn is distributed as source plus tagged releases. Install with Go, generate plan JSON, then run your policies directly against it.
Install and run
go install github.com/idunn-cloud/norn/cmd/norn@latest
terraform plan -out tfplan
terraform show -json tfplan > plan.json
norn check --plan plan.json --policies ./policies
norn check --plan plan.json --policies ./policies --format sarif > results.sarif Example output
FAIL az-nsg-no-public-admin-ports [high/mandatory]
azurerm_network_security_rule.ssh_open (create)
SSH/RDP must not be reachable from the internet; use Bastion or a restricted source range.
UNKNOWN az-nsg-no-public-admin-ports [high/mandatory]
azurerm_network_security_rule.from_lb (create)
SSH/RDP must not be reachable from the internet; use Bastion or a restricted source range. (depends on values known only after apply)Current status
Public alpha: real core, still evolving
Norn is usable today for early adopters, especially Azure-focused teams, but the policy surface and surrounding ecosystem are still maturing.
What works today
- norn check for Terraform/OpenTofu plan JSON
- YAML policy sets with compile-time validation
- CEL evaluation over before, after, resource, and resources
- text, json, and sarif output
- fixture-based policy testing via norn test
- starter Azure policy pack
Planned next
- exception files with owner and expiry
- Terraform-specific helpers like changed("field")
- relationship helpers for cross-resource rules
- GitHub Action and packaged releases
- broader AWS and GCP policy packs
Feedback wanted
Help shape Norn while the surface is still forming
Early users are the fastest way to improve the product. If something made adoption harder than expected, or if you have a policy edge case to test, open an issue and share it.
Official project links