How do you test and validate Terraform code?
Learn how to test Terraform: fmt, validate, plan, static analysis with tflint and tfsec, plus integration testing using terraform test and Terratest.
Expected Interview Answer
You validate Terraform code in layers: run terraform fmt and terraform validate for syntax and consistency, terraform plan to preview changes, static analysis tools like tflint, tfsec or checkov for style and security, and integration tests with the native terraform test framework or Terratest to actually provision and assert on real resources.
The cheapest checks come first: fmt enforces canonical formatting, validate catches syntax and internal reference errors without hitting any provider, and plan shows exactly what would change so reviewers can catch surprises. Static and policy tools such as tflint, tfsec, checkov and OPA/Sentinel enforce security and organizational rules before apply. For real confidence you provision infrastructure in a throwaway environment and assert behavior using the built-in terraform test blocks (HCL-based) or Terratest (Go), then destroy it — this catches issues that only appear against a live provider.
- Catches errors early before any resource is created
- Enforces consistent formatting and style across the team
- Detects security and policy violations before apply
- Previews exact changes via the plan output
- Verifies real behavior through integration tests
AI Mentor Explanation
Testing Terraform is like preparing a team through graded practice before a real match: net sessions check basic technique cheaply (validate), a full practice game previews tactics (plan), the match referee enforces the laws (policy scans), and only a proper warm-up fixture against a live opponent proves the side actually performs (integration tests) before the real game counts.
Step-by-Step Explanation
Step 1
Format the code
Run terraform fmt to enforce canonical, consistent formatting.
Step 2
Validate syntax
Run terraform validate to catch syntax and internal reference errors without a provider call.
Step 3
Preview with plan
Run terraform plan to see exactly what will be created, changed or destroyed.
Step 4
Static and policy scans
Run tflint, tfsec, checkov or OPA/Sentinel to enforce style, security and org rules.
Step 5
Integration tests
Use terraform test or Terratest to provision real resources, assert behavior, then destroy.
What Interviewer Expects
- Awareness of the layered testing pyramid for IaC
- Difference between validate and plan
- Knowledge of static analysis tools like tflint and tfsec
- Familiarity with terraform test or Terratest
- Understanding of running tests in ephemeral environments
Common Mistakes
- Thinking terraform validate checks against the real cloud
- Skipping the plan review before apply
- Only running fmt and calling it tested
- Ignoring security scanning tools like tfsec or checkov
- Running integration tests against production infrastructure
Best Answer (HR Friendly)
“You test Terraform in layers: quick checks format and validate the code, a plan previews what will change, scanning tools catch security and policy issues, and integration tests spin up real infrastructure to confirm it behaves before tearing it down.”
Code Example
# Fast local checks
terraform fmt -check
terraform validate
terraform plan -out=tfplan
# Security / policy scanning
tfsec .
checkov -d .
# Native test (tests/s3.tftest.hcl)
# run "bucket_is_created" {
# command = plan
# assert {
# condition = aws_s3_bucket.logs.bucket == "my-app-logs"
# error_message = "Bucket name did not match"
# }
# }Follow-up Questions
- What is the difference between terraform validate and terraform plan?
- How does the native terraform test framework work?
- When would you choose Terratest over terraform test?
- What does tfsec check that validate does not?
- How do you keep integration tests from touching production?
MCQ Practice
1. What does terraform validate check?
validate checks configuration syntax and references locally without contacting a provider.
2. Which tool is used for security scanning of Terraform?
tfsec (like checkov) performs static security analysis on Terraform code.
3. Which approach actually provisions resources to assert behavior?
Integration tools like Terratest and the native test framework create real resources and assert on them.
Flash Cards
What does fmt do? — Rewrites code into canonical Terraform formatting.
validate vs plan? — validate checks syntax locally; plan previews real changes against the provider.
Security scanning tools? — tfsec and checkov perform static security and policy analysis.
Integration testing options? — Native terraform test (HCL) or Terratest (Go) against ephemeral infrastructure.