Test and Lint Before Anyone Reviews

1. 1

   tflint with the AWS ruleset

   The plugin block pins the ruleset version. tflint --init downloads it; --recursive lints every module.

   plugin "terraform" {
     enabled = true
     preset  = "recommended"
   }
   
   plugin "aws" {
     enabled = true
     version = "0.40.0"
     source  = "github.com/terraform-linters/tflint-ruleset-aws"
   }

   terminalcopy cmd

   $ tflint --init && tflint --recursive

   ── expected output ──

   Installing "aws" plugin...

   Installed "aws" (source: github.com/terraform-linters/tflint-ruleset-aws, version: 0.40.0)

   (no output = no issues)

2. 2

   Security scan, and a justified exception

   trivy flags the app tier's unrestricted egress. It's deliberate, so record why, right where the resource is defined. The comment must sit directly above the resource. Everything else trivy reports should be fixed, not ignored.

   # trivy:ignore:AVD-AWS-0104 App tasks call external payment/email APIs via NAT; egress
   # is limited at the network edge (NAT) and reviewed in security review SR-112.
   resource "aws_vpc_security_group_egress_rule" "app_all" {
     security_group_id = aws_security_group.app.id
     cidr_ipv4         = "0.0.0.0/0"
     ip_protocol       = "-1"
   }

   terminalcopy cmd

   $ trivy config --severity HIGH,CRITICAL .

   ── expected output ──

   infra/security.tf (terraform)

   Tests: 64 (SUCCESSES: 63, FAILURES: 1)

   Failures: 1 (HIGH: 0, CRITICAL: 1)

    

   AVD-AWS-0104 (CRITICAL): Security group rule allows unrestricted egress to any IP address.

   ══════════════════════════════════════════

   infra/security.tf:51-55

   ──────────────────────────────────────────

   51 ┌ resource "aws_vpc_security_group_egress_rule" "app_all" {

   52 │ security_group_id = aws_security_group.app.id

   53 │ cidr_ipv4 = "0.0.0.0/0"

   54 │ ip_protocol = "-1"

   55 └ }

3. 3

   Write tests for the ecs-service module

   Three tests: a worker (no load balancer) gets no load-balancer block and no request-count scaling; an API with a load balancer gets exactly one of each; an invalid CPU size is rejected by validation. The mock provider needs one hint, a realistic region for the aws_region data source, because the log configuration uses it.

   mock_provider "aws" {
     mock_data "aws_region" {
       defaults = { region = "ap-south-1" }
     }
   }
   
   variables {
     name               = "test-svc"
     container_name     = "app"
     cluster_id         = "arn:aws:ecs:ap-south-1:123456789012:cluster/test"
     image              = "123456789012.dkr.ecr.ap-south-1.amazonaws.com/test:1.0.0"
     execution_role_arn = "arn:aws:iam::123456789012:role/exec"
     task_role_arn      = "arn:aws:iam::123456789012:role/task"
     subnet_ids         = ["subnet-aaa", "subnet-bbb"]
     security_group_ids = ["sg-123"]
     log_group_name     = "/test/app"
   }
   
   run "worker_has_no_load_balancer" {
     command = plan
   
     assert {
       condition     = length(aws_ecs_service.this.load_balancer) == 0
       error_message = "A service without load_balancer must not attach to a target group."
     }
   
     assert {
       condition     = length(aws_appautoscaling_policy.requests) == 0
       error_message = "Workers without a load balancer must not get request-count scaling."
     }
   }
   
   run "api_gets_lb_and_request_scaling" {
     command = plan
   
     variables {
       load_balancer = {
         target_group_arn = "arn:aws:elasticloadbalancing:ap-south-1:123456789012:targetgroup/api/abc"
         container_port   = 8080
         resource_label   = "app/alb/123/targetgroup/api/abc"
       }
       autoscaling = { min = 2, max = 6, requests_per_target = 500 }
     }
   
     assert {
       condition     = length(aws_ecs_service.this.load_balancer) == 1
       error_message = "Expected exactly one load_balancer block."
     }
   
     assert {
       condition     = length(aws_appautoscaling_policy.requests) == 1
       error_message = "Expected request-count scaling when resource_label and requests_per_target are set."
     }
   
     assert {
       condition     = aws_appautoscaling_target.this.min_capacity == 2
       error_message = "min_capacity should follow autoscaling.min."
     }
   }
   
   run "rejects_invalid_fargate_cpu" {
     command = plan
   
     variables {
       cpu = 300
     }
   
     expect_failures = [var.cpu]
   }

   terminalcopy cmd

   $ cd modules/ecs-service && terraform init -backend=false >/dev/null && terraform test

   ── expected output ──

   tests/service.tftest.hcl... in progress

   run "worker_has_no_load_balancer"... pass

   run "api_gets_lb_and_request_scaling"... pass

   run "rejects_invalid_fargate_cpu"... pass

   tests/service.tftest.hcl... tearing down

   tests/service.tftest.hcl... pass

    

   Success! 3 passed, 0 failed.

4. 4

   Add the checks to the PR job

   Insert these steps before plan in the plan job. They need no AWS credentials, so failures show up in seconds. terraform-linters/setup-tflint and aquasecurity/trivy-action install the tools.

         - uses: terraform-linters/setup-tflint@v4
         - name: tflint
           run: tflint --init && tflint --recursive
         - name: trivy
           uses: aquasecurity/trivy-action@0.28.0
           with:
             scan-type: config
             severity: HIGH,CRITICAL
             exit-code: "1"
         - name: module tests
           run: |
             for m in modules/*/; do
               if ls "$m"tests/*.tftest.hcl >/dev/null 2>&1; then
                 (cd "$m" && terraform init -backend=false -input=false >/dev/null && terraform test)
               fi
             done

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.