4 / 8 · Book 8 · The Infrastructure Testing Pyramid← prev⊞ allnext →Get the book →
1.4The Complete IaC Testing Pipeline
Before we dive into individual tools, let us see the complete picture. This is what a mature IaC testing pipeline looks like:
+---------------------------------------------------------------+
| Developer pushes Terraform + K8s changes |
| |
| Stage 1: Static (seconds) |
| +-- terraform fmt --check |
| +-- terraform validate |
| +-- checkov / tfsec / trivy config |
| +-- kubeval / kubeconform |
| +-- OPA/Conftest custom policies |
| |
| Stage 2: Plan Analysis (30 seconds) |
| +-- terraform plan -> JSON |
| +-- Automated plan assertions (no destroys, no public SGs) |
| +-- AI agent review of plan diff |
| |
| Stage 3: Ephemeral Deploy (5-15 minutes) |
| +-- terraform apply to PR workspace |
| +-- Wait for health checks |
| +-- Post preview URL |
| |
| Stage 4: Integration Tests (5-20 minutes) |
| +-- API tests against ephemeral environment |
| +-- E2E browser tests |
| +-- Security scan (DAST) |
| +-- Performance baseline |
| |
| Stage 5: Cleanup (on merge/close) |
| +-- terraform destroy PR workspace |
+---------------------------------------------------------------+
Each subsequent chapter in this book corresponds to one or more of these stages. By the end, you will be able to implement this entire pipeline.