Static analysis examines plaintext infrastructure configuration or state before deployment, usually by parsing files rather than creating live resources. It detects incorrect values, inconsistent naming, dependency violations, and other configuration concerns without risking active systems. section 6.1.1
Apply static analysis as an early checkpoint in the infrastructure testing cycle:
- Define or modify the infrastructure configuration. section 6.1
- Parse the configuration, state, or—when necessary—a generated dry-run result. section 6.2 section 6.2.2
- Check expected names, values, counts, formats, dependencies, and module contracts. section 6.1.1 section 6.3
- Fix the configuration and rerun the tests; if correction is not practical, revert to a previously successful configuration. section 6.1.1
- Apply changes only after the static checks pass, then use dynamic tests to verify the active infrastructure. section 6.1
Unit tests isolate the smallest configuration subset and avoid live resources or dependencies. Contract tests extend the practice across modules by checking that outputs provide the expected values or formats to dependent inputs. Configuration files are preferred because dry runs may require provider API access, take longer, or expose sensitive identifiers. section 6.2 section 6.2.2 section 6.3
Testing a network configuration
A factory module defines a network named hello-world-network and three subnets dividing 10.0.0.0/16. Tests inspect the configuration without creating resources, checking the network name, subnet count, and subnet ranges. A pytest fixture can load network.tf.json; alternatively, Terraform can generate a plan and convert it to JSON with `terraform plan -out=dry_run` followed by `terraform show -json dry_run > dry_run.json`. A contract test can then verify that the network exposes a facade containing its name and CIDR range for a server module. section 6.2 section 6.2.2 section 6.3
Figure 6.2 Infrastructure testing indicates whether you can apply changes to a system. After applying changes, you can use additional tests to confirm that the changes succeeded.
Use the infrastructure testing cycle to place static checks before deployment and dynamic checks after deployment. section 6.1
