1 / 3 · Book 8 · The Infrastructure Testing Pyramid · drill: interview Q&A⊞ allnext →Get the book →
1.3Mapping the Testing Landscape
The IaC testing ecosystem is vast. Here is how the major tools map to the pyramid layers:
| Tool | Layer | What It Tests | Language | Cost |
|---|---|---|---|---|
| terraform fmt | Syntax | Code formatting | N/A | Free |
| terraform validate | Syntax | HCL structure | N/A | Free |
| TFLint | Static | Provider-specific rules | Go | Free |
| tfsec | Static | Security misconfigs | Go | Free |
| Checkov | Static | Security + compliance | Python | Free |
| Trivy (config) | Static | Multi-format scanning | Go | Free |
| OPA/Conftest | Static | Custom policies | Rego | Free |
| kube-score | Static | K8s best practices | Go | Free |
| Polaris | Static | K8s policy enforcement | Go | Free |
| kubeconform | Static | K8s schema validation | Go | Free |
| helm-unittest | Static | Helm template logic | YAML | Free |
| terraform plan | Plan | Change analysis | N/A | Free* |
| Terratest | Integration | Real infrastructure | Go | $$$ |
| Pulumi Automation API | Integration | Real infrastructure | TS/Py/Go | $$$ |
| LocalStack | Integration | AWS emulation | Python | Free |
| Testcontainers | Integration | Docker-based deps | Multi | Free |
*terraform plan requires cloud credentials but does not create resources.