SkyForge

tests/offline.tftest.hcl

mock_provider "aws" {
  mock_data "aws_ami" {
    defaults = {
      id           = "ami-0mockal2023example"
      architecture = "x86_64"
    }
  }

  mock_data "aws_availability_zones" {
    defaults = {
      names    = ["us-east-1a", "us-east-1b", "us-east-1c"]
      zone_ids = ["use1-az1", "use1-az2", "use1-az3"]
    }
  }

  mock_data "aws_caller_identity" {
    defaults = {
      account_id = "000000000000"
      arn        = "arn:aws:iam::000000000000:root"
      user_id    = "AIDMOCK"
    }
  }
}

variables {
  availability_zones = ["us-east-1a", "us-east-1b"]
}

run "ec2_dev_sg_and_tags" {
  command = plan

  module {
    source = "./single-ec2"
  }

  variables {
    env           = "dev"
    instance_type = "t3.small"
  }

  assert {
    condition     = output.instance_type == "t3.small"
    error_message = "dev example should plan a t3.small"
  }

  assert {
    condition = alltrue([
      for rule in output.ingress : !(rule.from_port <= 22 && rule.to_port >= 22)
    ])
    error_message = "host security group must not open port 22"
  }

  assert {
    condition = alltrue([
      for rule in output.ingress : !(
        rule.from_port <= 22 && rule.to_port >= 22 && contains(rule.cidrs, "0.0.0.0/0")
      )
    ])
    error_message = "host security group must not open port 22 to 0.0.0.0/0"
  }

  assert {
    condition = (
      length(output.resource_env_tags) > 0
      && alltrue([for tag in output.resource_env_tags : tag == "dev"])
    )
    error_message = "every taggable resource on the dev EC2 route must carry Env=dev"
  }
}

run "ec2_prod_size" {
  command = plan

  module {
    source = "./single-ec2"
  }

  variables {
    env           = "prod"
    instance_type = "t3.medium"
  }

  assert {
    condition     = output.instance_type == "t3.medium"
    error_message = "prod example should plan a t3.medium"
  }

  assert {
    condition     = output.instance_type != run.ec2_dev_sg_and_tags.instance_type
    error_message = "dev and prod instance types must differ"
  }

  assert {
    condition = (
      length(output.resource_env_tags) > 0
      && alltrue([for tag in output.resource_env_tags : tag == "prod"])
    )
    error_message = "every taggable resource on the prod EC2 route must carry Env=prod"
  }
}

run "ecs_dev_alb_role_and_tags" {
  command = plan

  module {
    source = "./ecs-fargate"
  }

  variables {
    env         = "dev"
    task_cpu    = 256
    task_memory = 512
    enable_nat  = true
    enable_rds  = false
  }

  assert {
    condition     = output.https_port == 443 && output.https_action == "forward"
    error_message = "the load balancer must forward on 443"
  }

  assert {
    condition     = output.http_port == 80 && output.http_action == "redirect"
    error_message = "port 80 must redirect and must not forward"
  }

  assert {
    condition = alltrue([
      for action in output.task_role_actions : action != "*" && !strcontains(action, "*:*")
    ]) && length(output.task_role_actions) > 0
    error_message = "the ECS task role must not allow *:*"
  }

  assert {
    condition = (
      length(output.resource_env_tags) > 0
      && alltrue([for tag in output.resource_env_tags : tag == "dev"])
    )
    error_message = "every taggable resource on the dev Fargate route must carry Env=dev"
  }
}

run "ecs_prod_size" {
  command = plan

  module {
    source = "./ecs-fargate"
  }

  variables {
    env         = "prod"
    task_cpu    = 512
    task_memory = 1024
    enable_nat  = true
    enable_rds  = false
  }

  assert {
    condition     = output.task_cpu == 512 && output.task_cpu != run.ecs_dev_alb_role_and_tags.task_cpu
    error_message = "dev and prod Fargate CPU sizes must differ"
  }

  assert {
    condition = (
      length(output.resource_env_tags) > 0
      && alltrue([for tag in output.resource_env_tags : tag == "prod"])
    )
    error_message = "every taggable resource on the prod Fargate route must carry Env=prod"
  }
}

run "ecs_without_nat" {
  command = plan

  module {
    source = "./ecs-fargate"
  }

  variables {
    env        = "dev"
    enable_nat = false
  }

  assert {
    condition     = output.https_port == 443 && output.http_action == "redirect"
    error_message = "turning NAT off must keep the listener rules"
  }
}

run "ecs_with_rds" {
  command = plan

  module {
    source = "./ecs-fargate"
  }

  variables {
    env        = "dev"
    enable_rds = true
  }

  assert {
    condition     = alltrue([for tag in output.resource_env_tags : tag == "dev"])
    error_message = "RDS resources must carry Env=dev"
  }
}