Day 25/90: Terraform testing with Terratest

90 Day Security Infrastructure Challenge

A teammate's module change passed terraform validate , passed terraform plan with no errors, collected two approvals, and shipped a security group that no longer allowed 443. The module's whole job was to open HTTPS to the public load balancer. A refactor the week before had moved ingress into a dynamic block fed by a variable, and 443 fell out of that variable's list. Validate and plan both stayed green, because neither one runs the apply or reads the live resource. The first thing that noticed was a failing health check.

This post is the case for behavioral testing of IaC, and the structure of a Terratest test that would have caught it.

What validate and plan actually prove

terraform validate proves your configuration is well-formed: types line up, references resolve, blocks are legal. terraform plan proves what Terraform intends to change by diffing your config against state. Both are useful and both are fast.…