Testing
A misconfigured S3 bucket. An RDS instance without encryption. A security group open to 0.0.0.0/0. These are the infrastructure mistakes that make headlines. Policy-as-code tools like Checkov and Terrascan catch them at write time — before terraform apply ever runs. This guide explains how both
Testing
CDK for Terraform (CDKTF) lets you define infrastructure in TypeScript, Python, Go, or Java and synthesize it to Terraform JSON. This brings software testing practices to infrastructure: unit test your constructs, snapshot test synthesized output, and run integration tests against real cloud resources. This guide covers CDKTF testing from construct-
IaC Testing
The basics of Atlantis—comment atlantis plan on a PR, review the plan, apply—are well documented.
IaC Testing
Spacelift sits between Atlantis (self-hosted, minimal) and Terraform Cloud (SaaS, opinionated).
DevOps
Atlantis automates Terraform plan and apply through pull requests. But Atlantis itself needs testing: workflow configuration, plan output validation, policy enforcement, and server health checks. This guide covers testing Atlantis workflows locally with atlantis-local, validating plan outputs with custom scripts, enforcing Terraform policies with OPA and Conftest, and monitoring
DevOps
Terraform modules can look correct but deploy broken or insecure infrastructure. Checkov catches security misconfigurations statically before a plan runs. Terratest deploys real infrastructure to validate it works end-to-end. Together, they give you a complete testing pyramid for Terraform: fast static checks in every PR, and real infrastructure
Security Testing
Checkov ships with over 1,000 built-in checks — but every organization has requirements those built-ins don't cover.
Security Testing
tfsec is a static security scanner purpose-built for Terraform. Where Checkov supports many IaC formats, tfsec focuses entirely on Terraform and goes deeper: it resolves variable references, evaluates module calls, and understands Terraform's type system. The result is fewer false positives on complex configurations. Originally built by
Testing
Most Terratest tutorials cover the basics: deploy a module, assert an output, destroy it.
Testing
Infrastructure-as-Code introduced a new class of bug: the infrastructure configuration error.
Security Testing
Checkov is an open-source static analysis tool for Infrastructure as Code (IaC). It scans Terraform, Kubernetes, CloudFormation, Helm, Dockerfiles, and more for security misconfigurations and compliance violations. With 1000+ built-in checks and the ability to write custom checks in Python or YAML, Checkov catches misconfigurations before they'