How do you test Terraform code

Crisp answer: Terraform has a built-in test framework (terraform test). For broader testing use Terratest (Go) or Checkov for static analysis. At minimum: fmt, validate, and plan in CI before any apply.

Levels of Terraform testing:

1. Formatting and syntax:

terraform fmt -check -recursive  # Fails if files are not formatted
terraform validate                # Checks config syntax and internal references
                                  # Does not call AWS APIs — no auth needed

2. Static analysis:

# Checkov: security and compliance rules
checkov -d .
# Example failures:
# CKV_AWS_8: Ensure all data is encrypted (S3 bucket encryption not enabled)
# CKV_AWS_18: Ensure S3 bucket has access logging enabled

# tflint: provider-specific linting
tflint
# Example: invalid instance type, deprecated attributes

# tfsec: security scanner
tfsec .

3. terraform test (built-in, Terraform 1.6+):

# tests/vpc.tftest.hcl
run "creates_vpc_with_correct_cidr" {
  command = plan    # or apply (creates real resources)

  variables {
    cidr_block = "10.0.0.0/16"
  }

  assert {
    condition     = aws_vpc.main.cidr_block == "10.0.0.0/16"
    error_message = "VPC CIDR block is incorrect"
  }
}

terraform test              # Run all .tftest.hcl files
terraform test -filter=vpc  # Run specific test files

4. Terratest (integration testing in Go):

func TestVPCModule(t *testing.T) {
    opts := &terraform.Options{
        TerraformDir: "../modules/vpc",
        Vars: map[string]interface{}{
            "cidr_block": "10.0.0.0/16",
        },
    }
    defer terraform.Destroy(t, opts)
    terraform.InitAndApply(t, opts)

    vpcID := terraform.Output(t, opts, "vpc_id")
    assert.NotEmpty(t, vpcID)
}

Terratest actually deploys real resources and validates the outputs. Slow and costly but the highest confidence.

CI pipeline:

# Typical Terraform CI steps:
- terraform fmt -check
- terraform init
- terraform validate
- checkov -d .
- terraform plan -out=tfplan    # Save plan for review
# On merge to main:
- terraform apply tfplan

What to say in the interview:

"At minimum: fmt check, validate, and plan in CI on every PR. Plan output gets reviewed before anything merges. For security checks I use Checkov which catches things like unencrypted S3 buckets and missing access logging. Terraform 1.6 added a built-in test framework which lets you write assertions against plan output without spinning up real resources. For modules that need end-to-end validation, Terratest creates real infrastructure, runs assertions, and destroys it. Expensive but catches things that plan cannot."