1.2The Validation Pyramid

Infrastructure validation follows a pyramid similar to the traditional test pyramid, but with its own layers. Each layer catches different classes of issues at different costs:

        /\
       /  \        Integration tests (Terratest, real cloud resources)
      /    \
     /------\      Plan-time analysis (terraform plan, drift detection)
    /        \
   /----------\    Static analysis (validate, tfsec, checkov)
  /            \
 /--------------\  Syntax and format (terraform fmt, terraform validate)
/________________\

The bottom of the pyramid is free and fast. The top is expensive and slow but catches issues nothing else can. A mature IaC testing strategy uses all four layers, running the cheap checks on every commit and the expensive checks on critical module changes.

Layer 1: Syntax and Format (Milliseconds, Zero Cost)

These checks run in milliseconds, require no cloud credentials, and catch typos, missing fields, and style inconsistencies. Every commit should pass these checks before anything else runs.

Tools: terraform fmt, terraform validate, helm lint, kubeval

Layer 2: Static Analysis (Seconds, Zero Cost)

Static analysis tools scan your code for known security misconfigurations, compliance violations, and best practice deviations. They check against databases of thousands of rules without ever touching a cloud API.

Tools: tfsec, Checkov, Trivy (config mode), OPA/Conftest, kube-score, Polaris

Layer 3: Plan-Time Analysis (Seconds to Minutes, Low Cost)

Running terraform plan shows you exactly what will change in your infrastructure. Automated assertions against the plan output catch dangerous operations like resource deletions, replacements, and security group changes.

Tools: terraform plan + custom scripts, Pulumi preview, AI review agents

Layer 4: Integration Tests (Minutes to Hours, High Cost)

Integration tests deploy real infrastructure, run assertions against it, and tear it down. This is the only way to verify that your code actually works with real cloud APIs, but it costs real money and takes real time.

Tools: Terratest, Pulumi Automation API, ephemeral environments

Common Mistake: Many teams skip straight to integration tests because they feel more "real." This is a mistake. A single Terratest run can take 15-30 minutes and cost dollars. A static analysis scan takes 10 seconds and costs nothing. Always build from the bottom of the pyramid up.

Pro Tip: The fastest way to improve your IaC testing maturity is to add a pre-commit hook that runs terraform fmt -check and terraform validate. This takes 5 minutes to set up and catches a surprising number of issues before they ever reach CI.