# Beyond the Merge: Enforcing Policy Before the Terraform Apply

DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply](<https://devfeed.tech/articles/beyond-the-merge-enforcing-policy-before-the-terraform-apply-17660.md>)

Original publisher: [Read original article](<https://nirmata.com/2026/09/03/beyond-the-merge-enforcing-policy-before-the-terraform-apply/>)

Author: Sachin Agarwal

Published: 2026-09-03T17:25:32Z

Content type: article

Language: en

Sources: [Nirmata](<https://devfeed.tech/sources/nirmata.md>)

Topics: [iac-security](<https://devfeed.tech/topics/iac-security.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>), [Security](<https://devfeed.tech/topics/security.md>), [Kyverno](<https://devfeed.tech/topics/kyverno.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>)

Tags: [ci](<https://devfeed.tech/tags/ci.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [kyverno](<https://devfeed.tech/tags/kyverno.md>), [other](<https://devfeed.tech/tags/other.md>), [policy-as-code](<https://devfeed.tech/tags/policy-as-code.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [security](<https://devfeed.tech/tags/security.md>), [shift-left](<https://devfeed.tech/tags/shift-left.md>), [terraform](<https://devfeed.tech/tags/terraform.md>)

## AI overview

The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment.

## Source excerpt

Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource.