Skip to content
Sarj Sarj Sarj Standards

iac-source-coupled-test

Test uses raw Terraform/HCL text as an infrastructure-behavior oracle.

SARJ412 Rule source Tests Catalog JSON

Why

Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration without proving the plan or deployed behavior.

Fix

Assert on parsed configuration, Terraform test or rendered plan/state JSON, provider state, or runtime behavior. When exact source representation is the contract, suppress the assertion with that rationale.

Examples

Before — flagged Do not prove Terraform behavior with a substring
tests/test_policy.py
from pathlib import Path




def test_policy():
    source = Path("main.tf").read_text()
    assert "prevent_destroy = true" in source
After — preferred Assert on structured Terraform plan behavior
tests/test_policy.py
def test_policy(rendered_plan_json: str):
    plan = json.loads(rendered_plan_json)
    changes = plan["resource_changes"]
    assert changes[0]["change"]["actions"] == ["create"]