Write a conftest policy in Rego to enforce Terraform IaC rules and run it in CI

Steps

1. Install conftest from the official releases and verify with `conftest --version`; it parses Terraform HCL, JSON plan output, Kubernetes YAML, and over 18 other formats.
2. Run `terraform show -json tfplan > plan.json` to export the plan as structured JSON that conftest can parse.
3. Write a Rego policy file, e.g. `policy/main.rego`, with `package main` and denial rules such as `deny[msg] { ... }`.
4. Execute `conftest test plan.json --policy policy/` from the repo root; conftest evaluates each deny and warn rule and exits non-zero if any denial fires.
5. Add `conftest pull` with an OCI registry path to distribute shared policy bundles across teams without copying Rego files into every repo.
6. Integrate the conftest step into your CI pipeline between `terraform plan` (with `-out`) and `terraform apply`.