TS · testing

←Previous Next→

iac-source-coupled-test

Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.

rawSourceOracle Rule source Tests Catalog JSON

Why

Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.

Fix

Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.

Examples

Before — flagged Do not prove Terraform behavior with a regex

src/policy.test.ts

import { readFileSync } from "node:fs";
test("policy", () => {
  const source = readFileSync("main.tf", "utf8");
  expect(source).toMatch(/prevent_destroy/);
});

After — preferred Assert on rendered plan behavior

src/policy.test.ts

import { readFileSync } from "node:fs";
test("policy", () => {
  const plan = JSON.parse(readFileSync("plan.json", "utf8"));
  expect(validate(plan)).toEqual([]);
});