test(network): add tftest.hcl coverage for network/aws and network/azure#34
Closed
dmchaledev wants to merge 2 commits into
Closed
test(network): add tftest.hcl coverage for network/aws and network/azure#34dmchaledev wants to merge 2 commits into
dmchaledev wants to merge 2 commits into
Conversation
The network modules were the only modules without terraform test coverage. They underpin every tier (single-vm, ha-hot-hot, unlimited-scale), so a misconfigured subnet CIDR or missing Postgres delegation would cascade to all consumers. network/aws: - basic.tftest.hcl — apply with mocked AWS provider; checks all eight outputs (vpc_id, vpc_cidr, subnet lists, igw, NAT gateway IDs/IPs) - feature_flags.tftest.hcl — plan-only checks that enable_nat_gateway, enable_flow_logs, and az_count conditionals create/omit the right resource counts; all plan runs set enable_nat_gateway=false to avoid evaluating the private-route-table for_each from unknown mock IDs network/azure: - basic.tftest.hcl — apply with mocked azurerm provider; checks all six outputs (vnet_id, vnet_name, workload/lb/db subnet IDs, private DNS zone id/name) ci.yml: add network/aws and network/azure to the terraform-test matrix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0162Qhh6oX8BeGu9kM3LGhRv
3 tasks
dmchaledev
pushed a commit
that referenced
this pull request
Jun 26, 2026
…erage Folds two open PRs that could not be merged from their own branches (their mock-based tests broke once rebased and the branches are not pushable here); re-implemented with the test gaps fixed. #9 — VPC Flow Logs for single-vm/aws (closes #9): Adds opt-in VPC Flow Logs (enable_flow_logs, default true) sending ALL traffic to a CloudWatch log group, with a least-privilege flow-log IAM role. Closes the gap vs SECURITY-DEFAULTS.md. Forwarded through asm-aws-single / sat-aws-single with a flow_log_group_name output. The existing single-vm/aws basic test now mocks aws_cloudwatch_log_group with a valid ARN so aws_flow_log's log_destination passes provider-side ARN validation. #34 — terraform test coverage for the network modules (closes #34): Adds .tftest.hcl suites for network/aws (basic apply + feature-flag plans) and network/azure (basic apply), and adds both to the terraform-test CI matrix — the only modules previously lacking native tests. The azure test mocks azurerm_network_security_group, and both network/aws tests mock aws_cloudwatch_log_group, with well-formed ARNs so the subnet-NSG association and flow-log destination validate under the mock provider. Verified locally: terraform validate, tflint, terraform test (single-vm/aws 5/5, network/aws 5/5, network/azure 1/1), checkov (1078 passed, 0 failed), trivy (0 findings), and the wrapper drift check (0 warnings) all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFfgnPaoyGhp52vQL2PVU3
Contributor
Author
|
Superseded by #41 (merged), which adds the network/aws + network/azure Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The two
network/modules had zeroterraform testcoverage despite being the foundational landing zone consumed by every tier (single-vm, ha-hot-hot, unlimited-scale). A misconfigured subnet CIDR, a missing Postgres delegation block, or a broken NAT flag would only surface at customerterraform applytime — not in CI.The six tier modules all have
.tftest.hclsuites; this PR closes the remaining gap.Changes
modules/network/aws/tests/basic.tftest.hclMock-provider apply test with only the required
name_prefixvariable. Asserts all eight outputs are populated:vpc_id,vpc_cidr,public_subnet_ids(×2),private_subnet_ids(×2),db_subnet_ids(×2),internet_gateway_id,nat_gateway_ids(×2),nat_gateway_public_ips(×2).modules/network/aws/tests/feature_flags.tftest.hclPlan-only checks for the three boolean/numeric flags:
nat_disabled_creates_no_gatewaysenable_nat_gateway = falseaws_nat_gateway, 0aws_eipflow_logs_disabled_creates_no_resourcesenable_flow_logs = falseaws_flow_log, 0 log group, 0 IAM roleflow_logs_enabled_creates_one_setenable_flow_logs = true(default)three_az_span_creates_three_subnets_eachaz_count = 3All plan runs set
enable_nat_gateway = falseto avoid the private route-tablefor_eachreferencing mock NAT gateway IDs that are unknown at plan time (same constraint as thecreate_backup_bucketnote insingle-vm/aws).modules/network/azure/tests/basic.tftest.hclMock-provider apply test with the three required variables. Asserts all six outputs:
vnet_id,vnet_name,workload_subnet_id,lb_subnet_id,db_delegated_subnet_id,private_dns_zone_id, and thatprivate_dns_zone_name == "privatelink.postgres.database.azure.com". The Azure module has no conditional resources so a single run gives full coverage..github/workflows/ci.ymlAdds
network/awsandnetwork/azureto theterraform-testjob matrix so both modules are tested on every PR.Test plan
terraform init -backend=falseinmodules/network/awssucceedsterraform test -no-colorinmodules/network/aws— all 5 runs passterraform init -backend=falseinmodules/network/azuresucceedsterraform test -no-colorinmodules/network/azure— 1 run passesterraform-testmatrix shows 8 jobs (was 6): newnetwork/awsandnetwork/azurejobs green🤖 Generated with Claude Code
https://claude.ai/code/session_0162Qhh6oX8BeGu9kM3LGhRv
Generated by Claude Code