Infrastructure Testing and Policy as Code

1. 1

   Static checks in one go

   Run these locally and in CI on every PR (pre-commit hooks make them automatic).

   terminalcopy cmd

   $ terraform fmt -check -recursive && terraform -chdir=envs/dev validate

   tflint --recursive

   checkov -d . --quiet --compact | tail -3

   helm template charts/checkout | kubeconform -strict -summary

   ── expected output ──

   Success! The configuration is valid.

   Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"

   FAILED for resource: aws_s3_bucket.uploads

   Summary: 14 resources found in 1 file - Valid: 14, Invalid: 0, Errors: 0, Skipped: 0

2. 2

   A Terraform unit test with a mocked provider

   terraform test (Terraform 1.7+ for mocks) runs .tftest.hcl files. With mock_provider, no AWS credentials or resources are needed, so it's fast and safe on every PR. It asserts that the module computes what you expect.

   mock_provider "aws" {}
   
   variables {
     name     = "shoplite-test"
     cidr     = "10.50.0.0/16"
     az_count = 3
   }
   
   run "creates_one_private_subnet_per_az" {
     command = plan
     assert {
       condition     = length(aws_subnet.private) == 3
       error_message = "expected one private subnet per AZ"
     }
   }
   
   run "one_nat_gateway_per_az" {
     command = plan
     assert {
       condition     = length(aws_nat_gateway.this) == var.az_count
       error_message = "NAT gateways must be per-AZ (no single point of failure)"
     }
   }

   terminalcopy cmd

   $ terraform -chdir=modules/network init -backend=false && terraform -chdir=modules/network test

   ── expected output ──

   tests/network.tftest.hcl... in progress

   run "creates_one_private_subnet_per_az"... pass

   run "one_nat_gateway_per_az"... pass

   tests/network.tftest.hcl... tearing down

   tests/network.tftest.hcl... pass

    

   Success! 2 passed, 0 failed.

3. 3

   Policy as code with Rego and Conftest

   Deny public S3 bucket ACLs and require an owner tag on every resource that supports tags, evaluated against the JSON plan. It fails the pipeline before anything is applied.

   package main
   
   import rego.v1
   
   resources := [r | some r in input.resource_changes; r.change.after != null]
   
   deny contains msg if {
     some r in resources
     r.type == "aws_s3_bucket_acl"
     r.change.after.acl in {"public-read", "public-read-write"}
     msg := sprintf("%s: public S3 ACLs are not allowed", [r.address])
   }
   
   deny contains msg if {
     some r in resources
     tags := object.get(r.change.after, "tags_all", null)
     tags != null
     not tags.owner
     msg := sprintf("%s: missing required tag 'owner'", [r.address])
   }

   terminalcopy cmd

   $ terraform plan -out tf.plan && terraform show -json tf.plan > plan.json

   conftest test plan.json -p policy/

   ── expected output ──

   FAIL - plan.json - main - aws_s3_bucket.uploads: missing required tag 'owner'

   FAIL - plan.json - main - aws_s3_bucket_acl.uploads: public S3 ACLs are not allowed

    

   2 tests, 0 passed, 0 warnings, 2 failures, 0 exceptions

4. 4

   An integration test with Terratest

   Terratest (Go) applies real infrastructure in a sandbox account, checks it from the outside, and always destroys it (defer). Run it nightly or on module releases, not on every commit, because it's slow and costs money.

   package test
   
   import (
   	"testing"
   
   	"github.com/gruntwork-io/terratest/modules/aws"
   	"github.com/gruntwork-io/terratest/modules/terraform"
   	"github.com/stretchr/testify/assert"
   )
   
   func TestNetworkModule(t *testing.T) {
   	opts := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
   		TerraformDir: "../modules/network",
   		Vars:         map[string]interface{}{"name": "tt-network", "cidr": "10.60.0.0/16", "az_count": 2},
   	})
   	defer terraform.Destroy(t, opts)
   	terraform.InitAndApply(t, opts)
   
   	vpcID := terraform.Output(t, opts, "vpc_id")
   	subnets := aws.GetSubnetsForVpc(t, vpcID, "ap-south-1")
   	assert.Len(t, subnets, 4) // 2 public + 2 private
   }

   terminalcopy cmd

   $ cd test && go test -v -timeout 30m -run TestNetworkModule

   ── expected output ──

   --- PASS: TestNetworkModule (312.44s)

   PASS

   ok github.com/shoplite/infra/test 312.461s

Each drill is a real failure mode. Read the scenario and the output, decide what's wrong, then reveal the diagnosis.