🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🧪 धडा 11 — Testing आणि policy: आधी आराखडा वाचणारे तपासनीस

📍 तुम्ही इथे आहात: 12 पैकी धडा 11 · मागील: lesson-10-environments · पुढील: lesson-12-iac-cicd

📦 या ब्रँचमध्ये काय आहे

धडे 01–10, आणि काहीही बांधण्याच्या आधी चालणाऱ्या आपोआप तपासण्या: validate (आकार बरोबर आहे का?), tests (plan आपल्याला अपेक्षित तेच करतो का?), policy (याला परवानगी आहे का?) आणि cost (याला किती खर्च येईल?). तपासनीस plan वाचतात, campus नाही. policy() हे iac/demo.py मध्ये आहे; validate() हे iac/engine.py मध्ये; policy_check(), cost() आणि run_tests() हे iac/checks.py मध्ये.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

कोणताही plan कंत्राटदारापर्यंत पोहोचण्याआधी तो चार तपासनीसांच्या समोरून जातो. 🕵️🕵️🕵️🕵️

Form तपासणारी लिखाण पाहते: "या खोलीला नाव नाही. 'thirty' हा आकडा नाही. खोलीच्या form वर colour नावाचा रकानाच नाही. आणि हे gate अशा pool कडे बोट दाखवते जो आराखड्यात नाहीच." तिला कोणत्याही जागी जाण्याची गरज नसते.
Tester विचारते "plan तुम्हाला अपेक्षित तेच करतो का?" "तुम्हाला lab मध्ये 30 seats हव्या होत्या — हो. 2 lockers — हो. रात्री gates बंद — नाही, रात्रीचे gate 00-24 उघडे आहे."
नियम पाळणारी कडे शाळेचे नियम असतात: प्रत्येक खोलीला एक owner हवा; रात्री gates बंद व्हायला हवीत; खऱ्या campus शिवाय इतरत्र extra-large lockers नाहीत. ती तीन वेळा DENY म्हणते.
हिशेबनीस बेरीज करते: हा plan दर महिन्याला ₹2830 जास्त खर्च करतो.

चारही तपासण्या पार करणारा plan च कंत्राटदाराकडे जातो.

🗺️ आकृती

flowchart LR
    plans["📜 plans"] --> v["🖊️ validate<br/>shape: 4 errors"]
    v --> plan["📋 plan<br/>5 to add"]
    plan --> t["🧪 tests<br/>2 passed, 1 failed"]
    plan --> pol["🚫 policy<br/>3 DENY"]
    plan --> c["💰 cost<br/>+₹2830/month"]
    t & pol & c --> gate{"all green?"}
    gate -->|"yes"| apply["apply"]
    gate -->|"no"| fix["fix the plans"]

🗺️ रेखाटलेली आवृत्ती + एक lab: https://school-edh.pages.dev/terraform/lesson-diagrams.html#l11

❓ काय

terraform fmt -check — फक्त formatting. Format न केलेल्या files असतील तर build fail करते.
terraform validate — configuration provider schemas नुसार तपासते: अनोळखी arguments, गहाळ required arguments, चुकीचे types, declare न केलेले references. याला init लागते (schemas साठी) पण cloud credentials आणि state लागत नाहीत.
Linters — TFLint validate मध्ये नसलेले नियम जोडते (उदा. AWS साठी अवैध instance type).
terraform test (Terraform 1.6+) — run blocks असलेल्या *.tftest.hcl test files. प्रत्येक run plan किंवा apply करू शकतो (खऱ्या infrastructure वर, मग ते destroy करतो) आणि assert { condition = ... error_message = ... }. Mock providers (1.7+) मुळे tests cloud शिवाय चालतात.
Config मधील custom conditions — variable validation (धडा 04), lifecycle blocks मधील precondition आणि postcondition, आणि check blocks (1.5+).
Policy as code — plan JSON वरचे नियम (terraform show -json tfplan): conftest सह OPA (Rego मधील नियम), checkov, Trivy (ज्यात tfsec सामावले), HashiCorp Sentinel (HCP Terraform / Enterprise). नियम सांगतो की काय नाकारले जाते.
Cost estimation — Infracost plan ची किंमत काढते आणि महिन्याचा फरक pull request वर comment म्हणून लिहिते.

🤔 का

कारण plans वाचणाऱ्या माणसांकडून गोष्टी सुटतात, आणि काही चुका प्रत्येक वेळी त्याच असतात: public bucket, गहाळ tag, रात्रभर उघडे gate, dev मध्ये प्रचंड instance. प्रत्येक plan वर चालणारी तपासणी त्या review आधीच पकडते, आणि नियम कोणाच्या तरी डोक्यात न राहता code मध्ये दिसतात. Plan वरच्या तपासण्या स्वस्त असतात: apply नाही, वाट पाहणे नाही, नंतरची साफसफाई नाही. command = apply सह terraform test पुढे जाऊन खऱ्या गोष्टी बांधते, जे हळू असते आणि पैसे खर्च करते, म्हणून बहुतेक teams ते modules साठीच ठेवतात.

🔧 कसे (या repo मध्ये)

iac/engine.py मधील validate(cfg) प्रत्येक block SCHEMAS नुसार तपासते, Terraform च्याच error शब्दरचनेत. iac/checks.py मधील POLICIES ही (name, rule) ची यादी आहे; प्रत्येक rule एक planned बदल (आणि environment) पाहतो आणि नाकारण्याचे कारण परत देतो — Python मध्ये लिहिलेल्या Rego deny rule चाच आकार. cost(p) plan च्या आधी आणि नंतरच्या resources ची काल्पनिक रुपयांच्या किंमतींनी किंमत काढते. run_tests() रिकाम्या नोंदवहीवर plan करते आणि प्रत्येक assertion तपासते, terraform test प्रमाणेच Success! किंवा Failure! छापते.

🧪 करून पाहा

python3 iac/demo.py policy
python3 - <<'EOF'
import sys, copy; sys.path.insert(0, "iac")
from cloud import FakeCloud
from engine import plan
from checks import policy_check, cost, POLICIES
from demo import POLICY
p = plan(POLICY, None, FakeCloud())
for env in ("dev", "prod"): print(f"{env:<5} → {len(policy_check(p, env))} denied")
fixed = copy.deepcopy(POLICY)
fixed["resource"]["school_room"]["gym"]["tags"] = {"owner": "aishwarya"}
fixed["resource"]["school_gate"]["night"]["open_hours"] = "06-22"
fixed["resource"]["school_locker"]["big"]["size"] = "m"
q = plan(fixed, None, FakeCloud())
print("fixed →", policy_check(q, "dev"), "· cost", cost(q))
print(len(POLICIES), "rules")
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

policy हे छापते:

   school_room.gym: Inappropriate value for attribute "seats": a number is required.
   school_room.gym: An argument named "colour" is not expected here.
   school_room.gym: The argument "name" is required, but no definition was found.
   school_gate.g: Reference to undeclared resource "school_room.pool".
   DENY school_room.gym: every room needs an owner tag (tags has no 'owner')
   DENY school_gate.night: gates must close at night (open_hours = '00-24')
   DENY school_locker.big: no xl lockers outside prod (size = 'xl' in dev)
── cost estimate: ₹0/month → ₹2830/month (+2830) — made-up prices, the shape of an Infracost comment
     run "the lab has 30 seats"... pass
     run "the lab gets 2 lockers"... pass
     run "gates close at night"... fail
   Failure! 2 passed, 1 failed.

तुमचा snippet हे छापतो:

dev   → 3 denied
prod  → 2 denied
fixed → [] · cost (0, 2780)
3 rules

🏁 तुम्ही आत्ताच काय सिद्ध केले

Validate ला campus, नोंदवही किंवा plan शिवाय 4 चुका सापडल्या. तोच plan dev मध्ये 3 वेळा आणि prod मध्ये 2 वेळा नाकारला गेला — policy environment वर अवलंबून असू शकते (prod मध्ये xl lockers ना परवानगी आहे). तीन एक-ओळी दुरुस्त्यांनंतर काहीच नाकारले गेले नाही, आणि खर्च ₹2830 वरून ₹2780 वर आला कारण xl locker m झाला. अपयशी test ने policy ने पकडलेलेच रात्रीचे gate पकडले: tests सांगतात की हे config काय करायलाच हवे; policies सांगतात की कोणतेही config काय करू शकते.

⚠️ नेहमीच्या चुका

policy फक्त .tf source वर चालवणे — variables आणि modules मधील मूल्ये फक्त plan मध्येच दिसतात
कोणालाच वाचता न येणारे नियम, आणि समस्या कशी दुरुस्त करायची हे सांगणारा कोणताही message नसणे
फक्त इशारा देणारी policy check — ते महत्त्वाचे असेल तर merge थांबवायलाच हवा
cleanup शिवाय, सामायिक account वर command = apply सह terraform test
cost estimate ला बिल समजणे — तो list prices आणि वापराच्या अंदाजावरून काढलेला अंदाज आहे

🏭 प्रत्यक्ष वापरात

खऱ्या account वर — pipeline चालवते त्या तपासण्या, क्रमाने:

terraform fmt -check -recursive
terraform init -backend=false && terraform validate
tflint --recursive
terraform plan -out=tfplan && terraform show -json tfplan > plan.json
conftest test plan.json --policy policy/         # OPA / Rego rules
checkov -f plan.json                             # built-in rules for common cloud mistakes
infracost breakdown --path plan.json             # monthly cost of the plan
terraform test                                   # runs tests/*.tftest.hcl (Terraform 1.6+)

एक test file (tests/lab.tftest.hcl):

run "locker_names_start_with_env" {
  command = plan
  variables { env = "dev" }
  assert {
    condition     = aws_s3_bucket.locker["a"].bucket == "dev-school-locker-a"
    error_message = "locker bucket names must start with the environment"
  }
}

एक conftest rule (policy/tags.rego, Rego v1 syntax):

package main

deny contains msg if {
  rc := input.resource_changes[_]
  rc.type == "aws_s3_bucket"
  not rc.change.after.tags.owner
  msg := sprintf("%s: every bucket needs an owner tag", [rc.address])
}

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे आहे: तुमच्या शेवटच्या तीन incidents शी जुळणाऱ्या तीन policies ने सुरुवात करा, त्या merge थांबवतील असे करा, आणि प्रत्येकीला दुरुस्तीचा स्पष्ट message द्या.

⏭️ पुढे

सगळे conveyor belt वर ठेवायला तयार आहे: प्रत्येक pull request वर plan, merge वर apply, साठवलेल्या keys नाहीत. पुढे: CI/CD मधील IaC — आणि संपूर्ण चित्र.

git checkout lesson-12-iac-cicd

🧪 Lesson 11 — Testing & policy: inspectors who read the plans first

📍 You are here: Lesson 11 of 12 · Previous: lesson-10-environments · Next: lesson-12-iac-cicd

📦 What's in this branch

Lessons 01–10, plus automatic checks that run before anything is built: validate (is the shape right?), tests (does the plan do what we meant?), policy (is it allowed?) and cost (what will it cost?). The inspectors read the plan, not the campus. policy() in iac/demo.py; validate() in iac/engine.py; policy_check(), cost() and run_tests() in iac/checks.py.

🧒 Explain like I'm 5

Before any plan reaches the contractor, it goes past four inspectors. 🕵️🕵️🕵️🕵️

The form checker looks at the writing: "This room has no name. 'thirty' is not a number. There is no box called colour on a room form. And this gate points at a pool that isn't in the plans." She doesn't need to visit any site.
The tester asks "does the plan do what you meant?" "You meant the lab to have 30 seats — yes. 2 lockers — yes. Gates closed at night — no, the night gate is open 00-24."
The rule keeper has the school's rules: every room needs an owner; gates close at night; no extra-large lockers except in the real campus. She says DENY three times.
The accountant adds it up: this plan costs ₹2830 a month more.

Only a plan that passes all four goes to the contractor.

🗺️ Diagram

flowchart LR
    plans["📜 plans"] --> v["🖊️ validate<br/>shape: 4 errors"]
    v --> plan["📋 plan<br/>5 to add"]
    plan --> t["🧪 tests<br/>2 passed, 1 failed"]
    plan --> pol["🚫 policy<br/>3 DENY"]
    plan --> c["💰 cost<br/>+₹2830/month"]
    t & pol & c --> gate{"all green?"}
    gate -->|"yes"| apply["apply"]
    gate -->|"no"| fix["fix the plans"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/terraform/lesson-diagrams.html#l11

❓ What

terraform fmt -check — formatting only. Fails the build on unformatted files.
terraform validate — checks the configuration against the provider schemas: unknown arguments, missing required ones, wrong types, undeclared references. It needs init (for the schemas) but no cloud credentials and no state.
Linters — TFLint adds rules validate does not have (for example, an invalid instance type for AWS).
terraform test (Terraform 1.6+) — test files *.tftest.hcl with run blocks. Each run can plan or apply (to real infrastructure, then destroy it) and assert { condition = ... error_message = ... }. Mock providers (1.7+) let tests run without a cloud.
Custom conditions in the config — variable validation (lesson 04), precondition and postcondition in lifecycle blocks, and check blocks (1.5+).
Policy as code — rules over the plan JSON (terraform show -json tfplan): OPA with conftest (rules in Rego), checkov, Trivy (which absorbed tfsec), HashiCorp Sentinel (HCP Terraform / Enterprise). A rule says what is denied.
Cost estimation — Infracost prices a plan and comments the monthly difference on the pull request.

🤔 Why

Because humans reading plans miss things, and some mistakes are the same every time: a public bucket, a missing tag, a gate open all night, a huge instance in dev. A check that runs on every plan catches them before review, and makes the rules visible in code instead of in someone's head. Checks on the plan are cheap: no apply, no waiting, no cleanup. terraform test with command = apply goes further and builds real things, which is slower and costs money, so most teams keep it for modules.

🔧 How (in this repo)

validate(cfg) in iac/engine.py checks each block against SCHEMAS, using Terraform's own error wording. POLICIES in iac/checks.py is a list of (name, rule); each rule looks at one planned change (and the environment) and returns a reason to deny — the shape of a Rego deny rule, written in Python. cost(p) prices the resources before and after the plan with made-up rupee prices. run_tests() plans against an empty register and checks each assertion, printing Success! or Failure! like terraform test.

🧪 Try it

python3 iac/demo.py policy
python3 - <<'EOF'
import sys, copy; sys.path.insert(0, "iac")
from cloud import FakeCloud
from engine import plan
from checks import policy_check, cost, POLICIES
from demo import POLICY
p = plan(POLICY, None, FakeCloud())
for env in ("dev", "prod"): print(f"{env:<5} → {len(policy_check(p, env))} denied")
fixed = copy.deepcopy(POLICY)
fixed["resource"]["school_room"]["gym"]["tags"] = {"owner": "aishwarya"}
fixed["resource"]["school_gate"]["night"]["open_hours"] = "06-22"
fixed["resource"]["school_locker"]["big"]["size"] = "m"
q = plan(fixed, None, FakeCloud())
print("fixed →", policy_check(q, "dev"), "· cost", cost(q))
print(len(POLICIES), "rules")
EOF

✅ Verify — what you should see

policy prints:

   school_room.gym: Inappropriate value for attribute "seats": a number is required.
   school_room.gym: An argument named "colour" is not expected here.
   school_room.gym: The argument "name" is required, but no definition was found.
   school_gate.g: Reference to undeclared resource "school_room.pool".
   DENY school_room.gym: every room needs an owner tag (tags has no 'owner')
   DENY school_gate.night: gates must close at night (open_hours = '00-24')
   DENY school_locker.big: no xl lockers outside prod (size = 'xl' in dev)
── cost estimate: ₹0/month → ₹2830/month (+2830) — made-up prices, the shape of an Infracost comment
     run "the lab has 30 seats"... pass
     run "the lab gets 2 lockers"... pass
     run "gates close at night"... fail
   Failure! 2 passed, 1 failed.

Your snippet prints:

dev   → 3 denied
prod  → 2 denied
fixed → [] · cost (0, 2780)
3 rules

🏁 What you just proved

Validate found 4 mistakes without a campus, a register or a plan. The same plan was denied 3 times in dev and 2 times in prod — policy can depend on the environment (xl lockers are allowed in prod). After three one-line fixes, nothing was denied, and the cost dropped from ₹2830 to ₹2780 because the xl locker became an m. The failing test caught the same night gate as the policy: tests say what this config must do; policies say what every config may do.

⚠️ Common mistakes

running policy on the .tf source only — values from variables and modules are only visible in the plan
rules nobody can read, with no message saying how to fix the problem
a policy check that only warns — if it matters, it must block the merge
terraform test with command = apply against a shared account, with no cleanup
treating the cost estimate as a bill — it is an estimate from list prices and usage guesses

🏭 In production

On a real account — the checks a pipeline runs, in order:

terraform fmt -check -recursive
terraform init -backend=false && terraform validate
tflint --recursive
terraform plan -out=tfplan && terraform show -json tfplan > plan.json
conftest test plan.json --policy policy/         # OPA / Rego rules
checkov -f plan.json                             # built-in rules for common cloud mistakes
infracost breakdown --path plan.json             # monthly cost of the plan
terraform test                                   # runs tests/*.tftest.hcl (Terraform 1.6+)

A test file (tests/lab.tftest.hcl):

run "locker_names_start_with_env" {
  command = plan
  variables { env = "dev" }
  assert {
    condition     = aws_s3_bucket.locker["a"].bucket == "dev-school-locker-a"
    error_message = "locker bucket names must start with the environment"
  }
}

A conftest rule (policy/tags.rego, Rego v1 syntax):

package main

deny contains msg if {
  rc := input.resource_changes[_]
  rc.type == "aws_s3_bucket"
  not rc.change.after.tags.owner
  msg := sprintf("%s: every bucket needs an owner tag", [rc.address])
}

🏭 Why this matters in production: start with three policies that match your last three incidents, make them block the merge, and add a clear fix message to each.

⏭️ Next

Everything is ready to put on a conveyor belt: plan on every pull request, apply on merge, no stored keys. Next: IaC in CI/CD — and the whole picture.

git checkout lesson-12-iac-cicd

← Previousenvironments Next →iac cicd

This page is the lesson's README from the lesson-11-testing-policy branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.