如何在 terratest 中扮演一个角色

Question

I'm working on writing test case for a terraform module. I have an assume role, and i would like to pass it to my go test. I'm not sure how to pass it . I defined it as a const and then how should i pass it such that it gets evoked during terraform init and terraform apply, destroy.

package test

import (
    "testing"

    "github.com/gruntwork-io/terratest/modules/aws"
    "github.com/gruntwork-io/terratest/modules/terraform"
    "github.com/stretchr/testify/assert"
    "github.com/stretchr/testify/require"
)


// An example of how to test the Terraform module in examples/terraform-aws-network-example using Terratest.
func TestTerraformAwsNetworkExample(t *testing.T) {
    t.Parallel()

    const authAssumeRoleEnvVar = "TERRATEST_IAM_ROLE"

    // Give the VPC and the subnets correct CIDRs
    vpcCidr := "1x.x.x.x/20"
    Env := "staging"
    privateSubnetCidr := []string{"1x.x.x.x/30"}
    publicSubnetCidr := []string{"1x.x.x.x/30"}
    Tag := map[string]string{"owner":"xxx"}
    awsRegion := "us-east-1"

    terraformOptions := &terraform.Options{
        // The path to where our Terraform code is located
        TerraformDir: "..",

        // Variables to pass to our Terraform code using -var options
        Vars: map[string]interface{}{
            "vpc_cidr":       vpcCidr,
            "env": Env,
            "private_subnet_cidrs": privateSubnetCidr,
            "public_subnet_cidrs":  publicSubnetCidr,
            "tags" : Tag,
        },

        EnvVars: map[string]string{
                 "AWS_DEFAULT_REGION": awsRegion,

        },
    }

    // At the end of the test, run `terraform destroy` to clean up any resources that were created
    defer terraform.Destroy(t, terraformOptions)

    // This will run `terraform init` and `terraform apply` and fail the test if there are any errors
    terraform.InitAndApply(t, terraformOptions)

    // Run `terraform output` to get the value of an output variable
    publicSubnetId := terraform.Output(t, terraformOptions, "public_subnet_ids")
    privateSubnetId := terraform.Output(t, terraformOptions, "private_subnet_ids")
    vpcId := terraform.Output(t, terraformOptions, "vpc_id")

    subnets := aws.GetSubnetsForVpc(t, vpcId, awsRegion)

    require.Equal(t, 2, len(subnets))
    // Verify if the network that is supposed to be public is really public
    assert.True(t, aws.IsPublicSubnet(t, publicSubnetId, awsRegion))
    // Verify if the network that is supposed to be private is really private
    assert.False(t, aws.IsPublicSubnet(t, privateSubnetId, awsRegion))
}

Answer 1

**

This piece of code is not testable, so you can't test it.

** https://github.com/gruntwork-io/terratest/blob/f3916f7a5f58e3fedf603388d3e3e8052d6a47a3/modules/aws/auth.go#L18

I wish they could have refactor it like this:

var AuthAssumeRoleEnvVar string

func SetAuthAssumeRoleEnvVar(role string){
    AuthAssumeRoleEnvVar = role
}

func NewAuthenticatedSession(region string) (*session.Session, error) {
    if assumeRoleArn, ok := os.LookupEnv(AuthAssumeRoleEnvVar); ok {
        return NewAuthenticatedSessionFromRole(region, assumeRoleArn)
    } else {
        return NewAuthenticatedSessionFromDefaultCredentials(region)
    }
}

So that we could call it something like this:

aws.SetAuthAssumeRoleEnvVar("testrole")
aws.NewAuthenticatedSession(region)

Answer 2

The only way to pass this variable TERRATEST_IAM_ROLE as os environment variable as mentioned in the doc You can also define it your backend file, but that would not be picked up if you have assert test cases that reads values, since it uses aws cli

So I did something this , and it worked.

import (

    "os"


)
 os.Setenv("TERRATEST_IAM_ROLE", "arn:aws:iam::xxxx/xxxx")