Terraform Testing

# Module structure: modules/vpc/
# tests/vpc_basic.tftest.hcl — unit test for the VPC module

# Provider mock — no real AWS calls, no credentials needed, runs in seconds
mock_provider "aws" {
  mock_resource "aws_vpc" {
    defaults = {
      id         = "vpc-mock-12345"
      arn        = "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-mock-12345"
      cidr_block = "10.0.0.0/16"
    }
  }
  mock_resource "aws_subnet" {
    defaults = {
      id                = "subnet-mock-67890"
      availability_zone = "us-east-1a"
    }
  }
  mock_data "aws_availability_zones" {
    defaults = {
      names = ["us-east-1a", "us-east-1b", "us-east-1c"]
    }
  }
}

# Test 1: Basic VPC creation with default inputs
run "creates_vpc_with_defaults" {
  command = plan  # No real resources — plan only

  variables {
    name = "test-vpc"  # Only required variable — rest use defaults
  }

  # Assert outputs are correct
  assert {
    condition     = output.vpc_id != ""
    error_message = "vpc_id output must not be empty"
  }

  assert {
    condition     = output.vpc_cidr_block == "10.0.0.0/16"
    error_message = "vpc_cidr_block should default to 10.0.0.0/16"
  }

  assert {
    condition     = length(output.public_subnet_ids) == 2
    error_message = "Should create 2 public subnets by default"
  }

  assert {
    condition     = length(output.private_subnet_ids) == 2
    error_message = "Should create 2 private subnets by default"
  }
}

# Test 2: Custom CIDR inputs
run "accepts_custom_cidr" {
  command = plan

  variables {
    name                 = "custom-cidr-vpc"
    vpc_cidr             = "172.16.0.0/16"
    public_subnet_cidrs  = ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"]
    private_subnet_cidrs = ["172.16.10.0/24", "172.16.11.0/24", "172.16.12.0/24"]
  }

  assert {
    condition     = output.vpc_cidr_block == "172.16.0.0/16"
    error_message = "vpc_cidr_block should reflect the custom CIDR"
  }

  assert {
    condition     = length(output.public_subnet_ids) == 3
    error_message = "Should create 3 public subnets when 3 CIDRs provided"
  }
}

# Test 3: Validation — invalid name should be caught
run "rejects_invalid_name" {
  command = plan

  variables {
    name = "INVALID NAME WITH SPACES"  # Violates the name validation rule
  }

  # Expect this run to fail — the validation should reject the input
  expect_failures = [var.name]
}

# Run the tests
terraform test

# Output:
# tests/vpc_basic.tftest.hcl... in progress
#   run "creates_vpc_with_defaults"... pass
#   run "accepts_custom_cidr"... pass
#   run "rejects_invalid_name"... pass
# tests/vpc_basic.tftest.hcl... tearing down
# tests/vpc_basic.tftest.hcl... pass
#
# Success! 3 passed, 0 failed.
# Elapsed: 0.8s — fast because mock_provider makes no API calls

# Run a specific test file
terraform test -filter=tests/vpc_basic.tftest.hcl

# Run in verbose mode — see each assertion result
terraform test -verbose

# tests/vpc_integration.tftest.hcl
# Integration test — creates real AWS resources
# Run in a dedicated test AWS account — never in production

provider "aws" {
  region = "us-east-1"
  # Credentials from environment — AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
  # Use a dedicated test account with limited permissions
}

# Run 1: Create the VPC — command = apply creates real AWS resources
run "create_vpc" {
  command = apply  # Real AWS API calls — creates real VPC, subnets, IGW

  variables {
    name    = "tf-test-vpc-${formatdate("YYYYMMDDHHmmss", timestamp())}"
    vpc_cidr = "10.99.0.0/16"  # Use a dedicated test CIDR range
  }

  # Assert the VPC ID is a valid AWS format
  assert {
    condition     = can(regex("^vpc-[a-f0-9]+$", output.vpc_id))
    error_message = "vpc_id must be a valid AWS VPC ID format"
  }

  # Assert subnets were created with IDs
  assert {
    condition     = length(output.public_subnet_ids) > 0
    error_message = "At least one public subnet must be created"
  }

  # Assert outputs reference the same VPC (cross-output consistency check)
  assert {
    condition     = output.vpc_cidr_block == "10.99.0.0/16"
    error_message = "vpc_cidr_block output must match the input cidr"
  }
}

# Run 2: Verify DNS resolution works in the VPC (uses state from run 1)
run "verify_dns" {
  command = plan  # Just check configuration — no new resources

  variables {
    name             = "tf-test-vpc-dns"
    vpc_cidr         = "10.99.0.0/16"
    enable_dns_hostnames = true
  }

  assert {
    condition     = output.vpc_id != ""
    error_message = "VPC must exist before testing DNS configuration"
  }
}

# After ALL runs complete: terraform destroy runs automatically
# All test resources are cleaned up — no manual cleanup needed

# precondition — checked at plan time, before the resource is created
# postcondition — checked after apply, verifying the actual created resource

resource "aws_db_instance" "main" {
  identifier        = "prod-${var.environment}"
  engine            = "postgres"
  engine_version    = var.engine_version
  instance_class    = var.instance_class
  allocated_storage = var.storage_gb
  storage_encrypted = var.storage_encrypted

  lifecycle {
    # Precondition: enforce contract on inputs before anything is created
    precondition {
      # Prod must be Multi-AZ — no exceptions, enforced at plan time
      condition     = var.environment != "prod" || var.multi_az == true
      error_message = "Production databases must have multi_az = true. Set multi_az = true in your module call."
    }

    precondition {
      # Storage must be encrypted — no unencrypted prod databases
      condition     = var.storage_encrypted == true
      error_message = "storage_encrypted must be true. Unencrypted databases are not permitted in this module."
    }

    precondition {
      # Production storage must be at least 100GB
      condition     = var.environment != "prod" || var.storage_gb >= 100
      error_message = "Production databases must have at least 100GB storage. Set storage_gb >= 100."
    }

    # Postcondition: verify the resource was actually created correctly
    postcondition {
      # After apply, verify AWS actually enabled encryption
      condition     = self.storage_encrypted == true
      error_message = "Database was created without encryption — AWS may have overridden the setting."
    }

    postcondition {
      # Verify the engine version AWS created matches what was requested
      condition     = startswith(self.engine_version, split(".", var.engine_version)[0])
      error_message = "AWS created a different major engine version than requested."
    }
  }
}

# output postcondition — verify module outputs meet their contract
output "db_endpoint" {
  value       = aws_db_instance.main.endpoint
  description = "Database connection endpoint"

  precondition {
    # Output must not be empty — if it is, something went wrong in apply
    condition     = aws_db_instance.main.endpoint != ""
    error_message = "Database endpoint is empty — the database may not have been created successfully."
  }
}

# .github/workflows/terraform-test.yml
# Run unit tests (fast) on every PR, integration tests (slow) on merge to main

name: Terraform Tests

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  # Fast tests — run on every PR, no cloud credentials needed
  unit-tests:
    name: Unit Tests (mocked)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with: { terraform_version: "1.6.3" }

      - name: Run unit tests for all modules
        run: |
          for module_dir in modules/*/; do
            echo "Testing $module_dir"
            cd "$module_dir"
            terraform init -backend=false  # No backend for unit tests
            terraform test -filter="tests/*unit*.tftest.hcl"
            cd -
          done

  # Slow tests — run only on merge to main, needs real AWS credentials
  integration-tests:
    name: Integration Tests (real AWS)
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    environment: test  # Dedicated test environment with separate AWS account

    permissions:
      id-token: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (test account)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.TEST_ACCOUNT_ROLE_ARN }}  # Test account only
          aws-region: us-east-1

      - uses: hashicorp/setup-terraform@v3
        with: { terraform_version: "1.6.3" }

      - name: Run integration tests for VPC module
        working-directory: modules/vpc
        run: |
          terraform init
          terraform test -filter="tests/*integration*.tftest.hcl"
          # terraform test automatically destroys created resources after each test file