Static analysis tools like Checkov and tflint analyse Terraform configurations without deploying any infrastructure. They are fast and cheap — seconds to run, no cloud costs. But they cannot verify that the deployed infrastructure actually works. A VPC module that passes all static checks might still produce subnets with wrong route tables, NAT gateways that cannot reach the internet, or security groups that block the traffic they are supposed to allow. Terratest fills this gap by running actual 'terraform apply', validating the live infrastructure through real API calls and network tests, and then running 'terraform destroy' to clean up. It bridges the gap between static analysis (what the configuration says) and integration testing (what the infrastructure actually does).
Terratest is a Go testing library — tests are written in Go using the standard 'testing' package, with Terratest providing helper functions for Terraform operations ('terraform.Apply()', 'terraform.Output()'), AWS resource inspection ('aws.GetPublicIpsOfEc2InstancesByTag()', 'aws.GetSqsQueueUrl()'), HTTP endpoint testing ('http_helper.HttpGetWithValidation()'), and SSH-based instance verification ('ssh.CheckSshCommandWithRetry()'). The Go ecosystem provides a mature testing framework, built-in parallelism (test suites can deploy to multiple environments simultaneously), and excellent tooling for managing test retries, timeouts and cleanup. Writing Terratest tests requires basic Go knowledge — variables, functions, error handling, and struct literals — but does not require advanced Go expertise. The Terratest pattern (apply → assert → destroy) is straightforward even for engineers with limited Go background.