feat(single-vm/aws): VPC flow logs + test(network): coverage (closes #9, #34)#41
Merged
Merged
Conversation
…erage Folds two open PRs that could not be merged from their own branches (their mock-based tests broke once rebased and the branches are not pushable here); re-implemented with the test gaps fixed. #9 — VPC Flow Logs for single-vm/aws (closes #9): Adds opt-in VPC Flow Logs (enable_flow_logs, default true) sending ALL traffic to a CloudWatch log group, with a least-privilege flow-log IAM role. Closes the gap vs SECURITY-DEFAULTS.md. Forwarded through asm-aws-single / sat-aws-single with a flow_log_group_name output. The existing single-vm/aws basic test now mocks aws_cloudwatch_log_group with a valid ARN so aws_flow_log's log_destination passes provider-side ARN validation. #34 — terraform test coverage for the network modules (closes #34): Adds .tftest.hcl suites for network/aws (basic apply + feature-flag plans) and network/azure (basic apply), and adds both to the terraform-test CI matrix — the only modules previously lacking native tests. The azure test mocks azurerm_network_security_group, and both network/aws tests mock aws_cloudwatch_log_group, with well-formed ARNs so the subnet-NSG association and flow-log destination validate under the mock provider. Verified locally: terraform validate, tflint, terraform test (single-vm/aws 5/5, network/aws 5/5, network/azure 1/1), checkov (1078 passed, 0 failed), trivy (0 findings), and the wrapper drift check (0 warnings) all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFfgnPaoyGhp52vQL2PVU3
This was referenced Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-implements two open PRs that couldn't be merged from their own branches (their mock-based tests fail once they pick up the now-merged changes, and I can't push fixes to the author branches). The feature code is theirs; I added the missing test mocks.
#9 — VPC Flow Logs for
single-vm/aws(closes #9)Opt-in VPC Flow Logs (
enable_flow_logs, defaulttrue) → CloudWatch log group, with a least-privilege flow-log IAM role. Closes the gap vsSECURITY-DEFAULTS.md. Forwarded throughasm-aws-single/sat-aws-singlewith aflow_log_group_nameoutput (descriptions match core, so the new drift check stays clean).single-vm/awsbasictftestnow mocksaws_cloudwatch_log_groupwith a valid ARN, soaws_flow_log.log_destinationpasses provider-side ARN validation under the mock provider (the original would have turned the test red).#34 —
terraform testcoverage for the network modules (closes #34)Adds
.tftest.hclfornetwork/aws(basic apply + feature-flag plans) andnetwork/azure(basic apply) — the only modules without native tests — and adds both to theterraform-testCI matrix.network/azuremocksazurerm_network_security_group, and bothnetwork/awstests mockaws_cloudwatch_log_group, with well-formed ARNs — required because the subnet→NSG association (added in fix(ci): repair trivy-action pin and close network/azure NSG gap #35) and the flow-log destination validate their ID/ARN format even under mocks.Verification (local)
terraform validate,tflint,terraform test(single-vm/aws 5/5, network/aws 5/5, network/azure 1/1),checkov(1078 passed, 0 failed),trivy(0 findings), wrapper drift check (0 warnings) — all pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01AFfgnPaoyGhp52vQL2PVU3
Generated by Claude Code