module

To test a module policy, add a mock module block to your test file. Use the meta attribute to set meta-attributes, including the module source and version. Use the attrs block to set values for any input variables defined by the module.

Note

This functionality is in beta. Do not use beta features in production environments.

Configuration model

module "<module_source>" "<test_case_name>" {
  meta = {
    source  = "<module_source>"
    version = "<module_version>"
    address = "<module_address>"
  }
  
  attrs = {
    <input_variable_name> = <input_variable_value>
  }
  
  expect_failure = <boolean>
  skip           = <boolean>
  
  input {
    <input_name> = <input_value>
  }
}

Complete configuration example

module "app.terraform.io/my-org/vpc/aws" "approved_version" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "2.0.0"
  }

  attrs = {
    name = "example-vpc"
    cidr = "10.0.0.0/16"
    azs  = ["us-east-1a", "us-east-1b"]
  }
}

module "app.terraform.io/my-org/vpc/aws" "old_version" {
  expect_failure = true
  
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "1.5.0"
  }

  attrs = {
    name = "example-vpc"
    cidr = "10.0.0.0/16"
  }
}

Specification

Labels

Module blocks support two labels.

Label	Required	Description
First label	Yes	The module source (For example: `"app.terraform.io/my-org/vpc/aws"`, `"./modules/networking"`).
Second label	Yes	A unique name for this test case within the test file.

Arguments

Resource blocks support the followng arguments.

Argument	Required	Type	Description
`meta`	No	Object	Meta-attributes for the module, including `source`, `version`, and `address`.
`attrs`	No	Object	Module input variables as defined by the module.
`prior_attrs`	No	Object	The module attributes before the operation (for `update` or `delete` operations).
`expect_failure`	No	Boolean	Set to `true` to expect this mock to fail the matching policies. Defaults to `false`.
`skip`	No	Boolean	Set to `true` to skip evaluating this mock against policies. Defaults to `false`.
`input`	No	Block	Set input values specific to this test case.

Depending on the operation being evaluated, the value of the attrs and prior_attrs attributes should contain different values as described in the following table.

Operation	`attrs.<name>`	`prior_attrs.<name>`
create	Target State	(unavailable/null)
update	Target State	Current State
delete	Target State (all resource attributes are null)	Current State

The `meta` argument

You can set the following meta values in the meta argument.

Attribute	Type	Description
`source`	String	The module source (For example: `"app.terraform.io/my-org/vpc/aws"`).
`version`	String	The module version (For example: `"2.0.0"`).
`address`	String	The logical address of the module within the configuration.

Examples

Test module version requirements

module "app.terraform.io/my-org/vpc/aws" "current_version" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "2.0.0"
  }

  attrs = {
    name = "production-vpc"
    cidr = "10.0.0.0/16"
  }
}

module "app.terraform.io/my-org/vpc/aws" "outdated_version" {
  expect_failure = true
  
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "1.0.0"
  }

  attrs = {
    name = "production-vpc"
    cidr = "10.0.0.0/16"
  }
}

Test approved module sources

module "git::github.com/org/terraform-aws-vpc" "approved_source" {
  meta = {
    source  = "git::github.com/org/terraform-aws-vpc"
    version = "2.0.0"
  }

  attrs = {
    vpc_name = "main"
    cidr     = "10.0.0.0/16"
  }
}

module "git::github.com/unknown/terraform-aws-vpc" "unapproved_source" {
  expect_failure = true
  
  meta = {
    source  = "git::github.com/unknown/terraform-aws-vpc"
    version = "2.0.0"
  }

  attrs = {
    vpc_name = "main"
    cidr     = "10.0.0.0/16"
  }
}

Test local modules

module "./modules/networking" "local_module" {
  meta = {
    source  = "./modules/networking"
    version = "1.0.0"
  }

  attrs = {
    environment = "production"
    vpc_cidr    = "10.0.0.0/16"
  }
}

Test with input variables

input "min_module_version" {
  type    = string
  default = "2.0.0"
}

module "app.terraform.io/my-org/vpc/aws" "configurable" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = input.min_module_version
  }

  attrs = {
    name = "vpc"
    cidr = "10.0.0.0/16"
  }
}

module "app.terraform.io/my-org/vpc/aws" "override_version" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "3.0.0"
  }

  attrs = {
    name = "vpc"
    cidr = "10.0.0.0/16"
  }
  
  input {
    min_module_version = "3.0.0"
  }
}

Test module with complex inputs

module "app.terraform.io/my-org/vpc/aws" "full_config" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "2.0.0"
  }

  attrs = {
    name = "production-vpc"
    cidr = "10.0.0.0/16"

    azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
    private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
    public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

    enable_nat_gateway = true
    enable_vpn_gateway = false

    tags = {
      Environment = "production"
      ManagedBy   = "terraform"
    }
  }
}

Test multiple module instances

module "app.terraform.io/my-org/vpc/aws" "production" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "2.0.0"
    address = "module.production_vpc"
  }

  attrs = {
    name = "production-vpc"
    cidr = "10.0.0.0/16"
  }
}

module "app.terraform.io/my-org/vpc/aws" "staging" {
  meta = {
    source  = "app.terraform.io/my-org/vpc/aws"
    version = "2.0.0"
    address = "module.staging_vpc"
  }

  attrs = {
    name = "staging-vpc"
    cidr = "10.1.0.0/16"
  }
}

Test version constraints

module "app.terraform.io/my-org/security-group/aws" "v2_x" {
  meta = {
    source  = "app.terraform.io/my-org/security-group/aws"
    version = "2.5.0"
  }

  attrs = {
    name        = "web-sg"
    description = "Security group for web servers"
  }
}

module "app.terraform.io/my-org/security-group/aws" "v3_x" {
  meta = {
    source  = "app.terraform.io/my-org/security-group/aws"
    version = "3.0.0"
  }

  attrs = {
    name        = "web-sg"
    description = "Security group for web servers"
  }
}

module "app.terraform.io/my-org/security-group/aws" "too_old" {
  expect_failure = true
  
  meta = {
    source  = "app.terraform.io/my-org/security-group/aws"
    version = "1.9.0"
  }

  attrs = {
    name        = "web-sg"
    description = "Security group for web servers"
  }
}

Write and run policy tests - Learn how to write and run tests
The module_policy {} block - Module policy reference