Lab: A tested module (terraform test, tflint, Checkov)

What you will learn in this TP

• Design a module with validations
• Test with mock_provider
• Analyse code security

Introduction #

What you will learn in this section

• Design a module with validations
• Test with mock_provider
• Analyse code security

Context. Several teams need compliant buckets. You provide a secure-by-default, automatically tested module.

Prerequisites: Terraform 1.10 or later, Docker, LocalStack and terraform-local (pip install localstack terraform-local); no cloud account or charges  ·  Estimated time: 50 min

A secure-by-default module with automated tests and analysis.

Hands-on #

Guided steps, with their solution.

1. 1. Write the module

   Why? A good module enforces best practices by default (versioning, public access block).

   Create modules/bucket with validated variables, resources and output.

2. 2. Test the module

   Why? The mock provider makes tests instant and independent of any cloud.

   Write modules/bucket/tests/bucket.tftest.hcl and run the tests.

3. 3. Analyse the code

   Why? tflint flags errors and conventions; Checkov reports security bad practices.

   Run tflint and Checkov on the module and read the findings (e.g. KMS encryption or access logging).

4. 4. Use the module

   Why? The root module simply assembles tested modules.

   Call the module twice with for_each from the root and apply on LocalStack.

Difficulty level : ●●●○○ (3/5)