Terraform Quickstart: Part 10 — Terraform Testing Guide

Learn how to test Terraform using various types of tests

Terraform Quickstart Tutorial. Image by the author.

Introduction

A team rolls out a new Terraform change to production. They accidentally referenced the wrong security group ID, resulting in critical services going offline. Downtime could have been avoided with a simple test.

Just like any application code, your Terraform configurations need testing. It helps catch errors early and improve the stability of your code.

Some frequent errors include:

• Using the wrong resource types or values.
• Breaking changes in modules.
• Security misconfigurations.
• Missing dependencies between resources.

In this chapter, you’ll learn:

• Types of tests used in Terraform projects.
• Common mistakes tests can catch.
• Tools you can use to test Terraform code.

Types of Terraform Tests

Tests help you validate changes before deployment, especially in CI/CD pipelines. Refer to this testing pyramid:

Terraform Testing Pyramid

Let’s explore the stages one by one:

1. Terraform Validate and Format

It checks if your config is syntactically correct and all required variables are defined.

$ terraform validate

Use this before every plan.

This ensures your files follow consistent formatting.

$ terraform fmt -check

It also avoids noisy diffs in version control.

2. Static Analysis

For example, tfsec is a 3rd party tool that detects issues like open security groups, public S3 buckets, missing encryption.

$ tfsec .

Checkov is another security scanner:

$ checkov -d .

It supports many cloud providers and has extensive policies.

3. Unit & Integration Testing with Terratest (Go)

Terratest is a Go framework for testing Terraform code. You can write tests like:

terraformOptions := &terraform.Options{
    TerraformDir: "../modules/my-vpc",
}
terraform.InitAndApply(t, terraformOptions)

This approach:

• Deploys real infrastructure
• Verifies with assertions (e.g. “Is the VPC created?”)
• Destroys after test run

It’s powerful but requires Go and more setup.

Best Practices for Testing in CI/CD

Include validation and scanning steps in your pipeline:

- name: Terraform Format
  run: terraform fmt -check
- name: Terraform Validate
  run: terraform validate
- name: tfsec Security Scan
  uses: aquasecurity/tfsec-action@v1.0.0

You can also trigger Terratest runs in a separate test job.

Hands-On Exercise: Writing a Unit Test for a Terraform Module

Imagine the following scenario:

You have a small Terraform module that creates a GitHub repository. You want to write a test to check:

• Can Terraform init and apply the module?
• Does the GitHub repo get created with the correct name?

You’ll need the following directory structure:

.
├── test/
│   └── github_repo_test.go
├── github-repo/
│   ├── main.tf
│   ├── variables.tf
│   └── outputs.tf

Preparations:

• Install the Go and Terratest dependencies.
• Set the GITHUB_TOKEN in your env or test file.

Let’s create a simple main.tf:

resource "github_repository" "repo" {
  name        = var.repo_name
  visibility  = var.visibility
  auto_init   = true
}
variable "repo_name" {
  type = string
}
variable "visibility" {
  type    = string
  default = "private"
}

Create the test/github_repo_test.go:

package test

import (
 "testing"
 "strings"
 "github.com/gruntwork-io/terratest/modules/terraform"
 "github.com/stretchr/testify/assert"
)
func TestGitHubRepo(t *testing.T) {
 t.Parallel()
 repoName := "terratest-example-repo"
 terraformOptions := &terraform.Options{
  TerraformDir: "../github-repo",
  Vars: map[string]interface{}{
   "repo_name": repoName,
   "visibility": "public",
  },
  EnvVars: map[string]string{
   "GITHUB_TOKEN": "<your_github_token>",
  },
 }
 defer terraform.Destroy(t, terraformOptions)
 terraform.InitAndApply(t, terraformOptions)
 output := terraform.Output(t, terraformOptions, "repo_name")
 assert.True(t, strings.Contains(output, repoName))
}

Run the test and check the results:

$ go test -v test/github_repo_test.go

Conclusion

In this chapter, you learned how to test Terraform code. Remember — start with formatting, validation, and scanning — and consider Terratest for advanced use cases.

Testing takes effort but pays off by catching issues early and avoiding bigger problems.

You can access the previous chapters here.

If you want the full Terraform beginner guide as a downloadable PDF, check out my Terraform Quickstart ebook on Gumroad.

Interested in more DevOps topics?

• *Kubernetes course*
• *Helm course*