Terraform AWS: How to create mocks for subnets

Terraform Providers AWS
1

I am trying to test if my data block is able to correctly retrieve the subnet ids, given a set of conditions. i.e.

data "aws_subnets" "app" {
  tags = {
    Tier = "app"
  }
}

I am currently creating mock resource for the subnet:

mock_resource "aws_subnet" {
  defaults = {
    vpc_id = "vpc-12345678"
    tags = {
      Tier = "app"
    }
  }
}

however, then I create a run block, the number of subnet ids seems to be 0. Can I ask why is that the case? Can I also ask how to mock multiple subnets? I want to be able to simulate getting data from multiple subnets

2

@Kurtyjlee While I am new to Terraform tests, if I understand how mocks work, I don’t think mocking aws_subnet resources would make them discoverable by a data source. After all, the actual data source would find subnets via AWS API, not from the Terraform state.

You can mock the data source by providing a default or overridden value for the ids attribute, though doing so would not be testing the logic of the actual data source.

Your other option is to consider creating a VPC and subnets as a setup module (following typical unit test concepts), so that there are real AWS resources for the actual data source to fetch. Here’s an example - hope is helps.

main.tf (the configuration with the data source that you want to test):

data "aws_subnets" "app" {
  tags = {
    Tier = "app"
  }
}

testing/setup/main.tf (the setup configuration that creates the VPC and subnets for actual tests):

resource "aws_vpc" "this" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "test-vpc"
    Tier = "app"
  }
}

resource "aws_subnet" "subnet1" {
  vpc_id            = aws_vpc.this.id
  cidr_block        = "10.0.0.0/24"
  availability_zone = "us-west-2a"

  tags = {
    Tier = "app"
  }
}

resource "aws_subnet" "subnet2" {
  vpc_id            = aws_vpc.this.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-west-2b"

  tags = {
    Tier = "app"
  }
}

main.tftest.hcl (the test configuration):

run "setup" {
  module {
    source = "./testing/setup"
  }
}

run "app_tier_subnets_found" {
  command = apply
  assert {
    condition     = length(data.aws_subnets.app.ids) == 2
    error_message = "The number of app-tier subnets found is incorrect"
  }
}

Console log from running the tests:

$ terraform init
Initializing the backend...
Initializing modules...
- test.main.setup in testing\setup
Initializing provider plugins...
- Reusing previous version of hashicorp/aws from the dependency lock file
- Using previously-installed hashicorp/aws v5.84.0
Terraform has made some changes to the provider dependency selections recorded
in the .terraform.lock.hcl file. Review those changes and commit them to your
version control system if they represent changes you intended to make.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

$ terraform test
main.tftest.hcl... in progress
  run "setup"... pass
  run "app_tier_subnets_found"... pass
main.tftest.hcl... tearing down
main.tftest.hcl... pass

Success! 2 passed, 0 failed.

$
1 Like
3

Hi @acwwat, thank you for the response! I tested the code and got this error

╷
│ Error: Test assertion failed
│ 
│   on tests/networking.tftest.hcl line 14, in run "app_tier_subnets_found":
│   14:     condition     = length(data.aws_subnets.app.ids) == 2
│     ├────────────────
│     │ data.aws_subnets.app.ids is empty list of string
│ 
│ The number of app-tier subnets found is incorrect

Do you know what might be wrong? Does it have to do with my providers?

Below is my entire sandbox codebase

main.tf

data "aws_subnets" "app" {
  tags = {
    Tier = "app"
  }
}

provider.tf

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "5.84.0"
    }
  }
}

tests/networking.tftest.hcl

mock_provider "aws" {
  
}

run "setup" {
  module {
    source = "./testing/setup"
  }
}

run "app_tier_subnets_found" {
  command = apply
  assert {
    condition     = length(data.aws_subnets.app.ids) == 2
    error_message = "The number of app-tier subnets found is incorrect"
  }
}

testing/setup/main.tf

resource "aws_vpc" "this" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "test-vpc"
    Tier = "app"
  }
}

resource "aws_subnet" "subnet1" {
  vpc_id            = aws_vpc.this.id
  cidr_block        = "10.0.0.0/24"
  availability_zone = "us-west-2a"

  tags = {
    Tier = "app"
  }
}

resource "aws_subnet" "subnet2" {
  vpc_id            = aws_vpc.this.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-west-2b"

  tags = {
    Tier = "app"
  }
}
4

@Kurtyjlee I believe that including mock_provider in tests/networking.tftest.hcl is causing all resources and data sources to be mocked. Since we want the resources defined in testing/setup/main.tf to be created, you’ll need to remove the mock provider.

If you must use both the real and mock providers, you can specify the appropriate providers configuration in each run block, similar to the last example in described in the Mock Providers section of the documentation.

1 Like
5

Nice it works, thank you so much!

I am currently working in an environment where access to the aws account is restricted to github workflows on another codebase. Can I check if this can be done without credentials to an aws account? is there a way for me to mock the provider such that resources can be created within that provider and be used for testing?

6

@Kurtyjlee It really depends on what you are trying to test. You can certainly mock your aws_subnets data sources as well, but does that really help you validate your configuration? Or are there other resources that depend on the aws_subnets data source that you want to test? If so, mocking the data source and the downstream resources could make sense.

Terraform testing is unfortunately outside my area of expertise as I am used to doing end-to-end tests, so you may need to refer to other resources (like this article from AWS or this article from Spacelift) or start another thread in the Terraform category (while tagging testing).

1 Like
7

Hi @Kurtyjlee - it’s not currently possible to get a mock provider to return created resources as data sources.

I’d recommend just overriding the data source directly with an override_data block. You can then control exactly what values are returned for that data in your future tests. If you want to just validate your conditions on the data source, the overridden data source will let you do this, as you can control the returned values to test pass and fail conditions for your condition.

This also works if you want to just use the output of the data source in other parts of your configuration - you can just control exactly what the data source says exists in the provider.

1 Like
8

Hi @liamcervante, thanks for the response! I am still a little unclear on how to use it for my use case of testing the “aws_subnets” data block condition. Do you mind giving an example on how to use the override_data block for this use case?

9

You can basically control the data returned by the data source, instead of needing to create real infrastructure for it to use:

override_data {
  target = data.aws_subnets.app
  values = {
    ids = ["vpc-12345", "vpc-67890"]
  }
}

The data source will now return those two values for the ids field. You can also combine this with a mock provider more generally, so you can test your configuration without needing an AWS account.

10

Can I check how do I use this to validate the data fetching for the subnet ids?

I would like to test if the subnets fetched from the data block has the tag Tier=“app”. With this override block, it merely overrides the subnet ids for the data block?