Blog

Validating and Testing Terraform Code: fmt, validate, tflint, terraform test, mock_provider and Policy

validate only tells you the code can run; to protect your own rules you need layers of tflint, security scanning and terraform test with mock_provider, none of which needs a cloud account. We see validate let a Web App lowered to TLS 1.1 through while a test stops it, triage tflint and Trivy findings, apply a whole Azure environment against mocks, write a real-provider test with Docker and put it all in one script.