Suppose a web service deploys successfully but fails to redirect HTTP traffic to HTTPS. A test case checks that specific behavior against an expected outcome. Several test cases can share one deployed configuration: endpoint responses, the redirect, and log delivery can all be checked before the infrastructure is torn down. Grouping checks matters because launching infrastructure can take time. section 9.2.1
Build tests around the configuration each set of checks needs:
- Choose configuration values, launch the resources, run checks against them, and tear the resources down. Aim to leave a clean slate. section 9.2.1
- Use separate tests when requirements conflict. A private S3 bucket for logging and a public bucket for static hosting need different configurations. section 9.2.1
- Keep checks simple and commented. Add a case when a bug is found so a later change is less likely to reintroduce it. section 9.2.1 section 9.0
The kind of test depends on what must be verified. Unit tests isolate logic, often replacing external dependencies with mocks; integration tests use real systems to check how components work together. Terraform modules configure external systems, so useful module tests often need those systems. Provider unit tests can check isolated functions, while acceptance tests exercise resources or data sources against a service and may incur costs. Neither automated tests nor scanners replace security-minded review: a misplaced database subnet or missing backups may still need a knowledgeable reviewer. section 9.1.4 section 12.3.3 section 7.1.3
A small initialization test
For a command wrapper, copy a test module into a temporary directory, initialize it with a pytest fixture, then assert that the .terraform directory exists. Each test gets its own copy rather than modifying a shared module. section 11.1.4
Choose the runner that fits the target. Go tests live in files ending _test.go and run with go test; Terratest tests Terraform modules in Go. The Terraform testing framework offers a Terraform-centric alternative. For provider functions, test expected inputs alongside unknown and null values; function tests require Terraform 1.8 or later. Checks and conditions serve a different purpose: assertions against long-running infrastructure, rather than only tests run during development. section 9.3.1 section 9.7 section 12.7.4 section 10.6
