Terraform

IaC Testing

Advanced Atlantis: Plan Policies, Custom Workflows, and Integration Testing

The basics of Atlantis—comment atlantis plan on a PR, review the plan, apply—are well documented. What's less covered is how to enforce policy at plan time, build reusable workflow components, and test your Atlantis configuration before it breaks a production PR. This post goes deep on

IaC Testing

Spacelift IaC Testing: Policies, Drift Detection, and Approval Workflows

Spacelift sits between Atlantis (self-hosted, minimal) and Terraform Cloud (SaaS, opinionated). It handles Terraform, Pulumi, Ansible, and CloudFormation from a single platform. But its differentiating features—OPA-based policies, drift detection, and stack dependency graphs—require deliberate configuration to be useful. Here's how to build a tested,

DevOps

Testing Atlantis Terraform PR Automation: Workflows, Plan Verification, and Policy Enforcement

Atlantis automates Terraform plan and apply through pull requests. But Atlantis itself needs testing: workflow configuration, plan output validation, policy enforcement, and server health checks. This guide covers testing Atlantis workflows locally with atlantis-local, validating plan outputs with custom scripts, enforcing Terraform policies with OPA and Conftest, and monitoring

DevOps

Terraform Testing with Checkov and Terratest: Unit and Integration Testing Guide

Terraform modules can look correct but deploy broken or insecure infrastructure. Checkov catches security misconfigurations statically before a plan runs. Terratest deploys real infrastructure to validate it works end-to-end. Together, they give you a complete testing pyramid for Terraform: fast static checks in every PR, and real infrastructure

Security Testing

Writing Custom Checkov Policies: Python and YAML for IaC Security Rules

Checkov ships with over 1,000 built-in checks — but every organization has requirements those built-ins don't cover. Naming conventions, internal tagging standards, specific CIDR allowlists, cross-resource validation — these need custom policies. Checkov supports two custom policy formats: Python classes for complex logic, and YAML for

Security Testing

tfsec: Static Security Analysis for Terraform Code

tfsec is a static security scanner purpose-built for Terraform. Where Checkov supports many IaC formats, tfsec focuses entirely on Terraform and goes deeper: it resolves variable references, evaluates module calls, and understands Terraform's type system. The result is fewer false positives on complex configurations. Originally built by

Testing

Terratest Advanced Patterns: Table-Driven Tests, Parallel Testing, and Module Fixtures

Most Terratest tutorials cover the basics: deploy a module, assert an output, destroy it. That gets you started, but production infrastructure codebases need more. Modules compose, environments differ, and running 40 sequential end-to-end tests takes hours. This guide covers the advanced Terratest patterns that make infrastructure test suites

Testing

Terraform Testing Guide: Terratest, tflint, and Validation Strategies

Infrastructure-as-Code introduced a new class of bug: the infrastructure configuration error. A missing variable, a wrong CIDR block, or an IAM permission misconfiguration can take down a service just as effectively as a software bug. Testing your Terraform code prevents these failures. This guide covers the full Terraform

Security Testing

Checkov for Terraform and Kubernetes IaC Security Testing

Checkov is an open-source static analysis tool for Infrastructure as Code (IaC). It scans Terraform, Kubernetes, CloudFormation, Helm, Dockerfiles, and more for security misconfigurations and compliance violations. With 1000+ built-in checks and the ability to write custom checks in Python or YAML, Checkov catches misconfigurations before they'