Testing infrastructure as code: validation, linting, and compliance

Infrastructure as code is still code, and it deserves the same testing rigor as your application code. A bug in your Terraform or CloudFormation can be more damaging than a bug in your application it can take down your entire infrastructure.

Start with syntax validation. Use terraform validate and terraform fmt in your CI pipeline. Catch basic errors before they reach production. These checks are fast and catch the most common mistakes like undefined variables or malformed resource definitions.

Add static analysis with tools like tfsec, checkov, or cfn-nag. These tools check your infrastructure code against security best practices: S3 buckets should be private, encryption should be enabled, security groups should be restrictive. Integrate these checks into CI and fail the build for critical violations.

Unit test your modules. Tools like terratest let you write tests that validate your Terraform modules. You can verify that a module creates the expected number of resources with the correct configuration.

Plan validation is one of the most powerful testing patterns. Run terraform plan against a non-production environment and assert on the planned changes. For example, assert that no security groups are modified, or that the number of resources remains the same.

Integration tests run terraform apply in a sandbox environment and verify that the resulting infrastructure works correctly. Deploy a VPC module, then verify that you can create resources in it. Integration tests are slower but provide the highest confidence.

Compliance testing verifies that your infrastructure meets organizational policies. Use tools like Open Policy Agent to write policy rules: all S3 buckets must have encryption enabled, all EBS volumes must be encrypted. Run compliance checks in CI and as part of your deployment pipeline.

Test destruction as well as creation. Your terraform destroy workflow should be tested to ensure that resources are cleaned up properly. A destroy that leaves dangling resources will accumulate costs and security risks over time.

-

Rizwan Saleem | https://rizwansaleem.co