🏗️ Testing & Code Quality

terraform test, validation, checkov, tfsec, pre-commit hooks

Terraform Associate · TF-Associate · ⏱️ 18 min · ❓ 3 savol

✅ Built-in Variable Validation

Variable da `validation` block: `condition` va `error_message`. Plan vaqtida tekshiriladi — apply ga borishmaydi. Masalan, region faqat ma'lum qiymatlar bo'lishi yoki instance type formatini tekshirish.

🧪 terraform test (Terraform 1.6+)

`.tftest.hcl` fayllar. `run` block — plan yoki apply run qilish. `assert` — shartlarni tekshirish. `expect_failures` — xato kutilayotgan holatlarni test qilish. Real infra yaratadi → test → yo'qotadi (sandbox account kerak).

🔍 Static Analysis: checkov & tfsec

checkov — Python, 1000+ security policy check (CIS Benchmark). `checkov -d .` yoki `checkov -f main.tf`. tfsec — Go, fast, SARIF format, GitHub Actions da native. Trivy — all-in-one (IaC + container + SBOM). CI/CD pipeline ga birgalikda qo'shing.

🎣 Pre-commit Hooks

pre-commit framework: `.pre-commit-config.yaml`. Hooks: `terraform fmt --check`, `terraform validate`, `terraform-docs` (README auto-generate), `checkov`, `tfsec`. Git commit dan oldin avtomatik tekshiradi. `pre-commit install` — bir marta sozlash.

💡 Asosiy nuqtalar

Variable validation: plan da xato, apply ga bormaslik
terraform test: .tftest.hcl, real infra test
checkov: 1000+ policy, Python, CIS Benchmark
tfsec: tez, Go, CI/CD uchun optimal
pre-commit: commit dan oldin avtomatik check

📋 Kod misoli

# Variable validation
variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment faqat dev, staging yoki prod bo'lishi mumkin."
  }
}

variable "aws_region" {
  type = string
  validation {
    condition     = can(regex("^[a-z]{2}-[a-z]+-[0-9]$", var.aws_region))
    error_message = "Region format noto'g'ri (masalan: us-east-1)."
  }
}

# terraform test (tests/main.tftest.hcl)
run "test_s3_bucket_created" {
  command = apply

  assert {
    condition     = aws_s3_bucket.main.bucket_prefix == "my-app-"
    error_message = "S3 bucket prefix noto'g'ri"
  }
}

# pre-commit config (.pre-commit-config.yaml)
# repos:
#   - repo: https://github.com/antonbabenko/pre-commit-terraform
#     hooks:
#       - id: terraform_fmt
#       - id: terraform_validate
#       - id: terraform_tfsec

🎯 Imtihon maslahatlari

Variable validation — runtime emas, plan vaqtida tekshiriladi
terraform test — Terraform 1.6+ dan beri built-in (oldin terratest ishlatilgan)
checkov vs tfsec: checkov ko'proq policy, tfsec tezroq. Ikkalasini birga ishlatish mumkin
terraform fmt vs terraform validate: fmt = format, validate = syntax/logic check
pre-commit hooks developer laptop da ishlaydi, CI/CD da alohida step ham kerak

⚠️ Ko'p adashadigan

terraform validate cloud API call qiladi deb o'ylash — validate faqat local syntax, plan esa API call
terraform test = unit test deb o'ylash — real infra yaratadi, sandbox kerak
checkov PASSED = xavfsiz deb hisoblash — faqat belgilangan policies tekshiriladi

🧠 Eslab qolish: "VTP" = Validate (syntax), Test (functional), Policy (security) — Terraform testing 3 qatlami