terraform-skill

### Terraform Module Validation & CI/CD Integration Plan

**Context**: We need to validate a new `aws-network` module for our production VPC before merging it into the main branch. The module includes subnets, route tables, and security groups. Our CI/CD pipeline uses GitHub Actions and requires OpenTofu 1.7+.

**Step 1: Local Validation**
1. Initialize the module in a test directory:
   ```bash
   mkdir -p /tmp/terraform-test && cd /tmp/terraform-test
   tofu init -upgrade
   ```
2. Validate the module syntax:
   ```bash
   tofu validate -json
   ```
3. Run a plan with strict mode enabled to catch potential issues:
   ```bash
   tofu plan -out=tfplan -var-file=test.tfvars -var 'environment=staging' -strict
   ```

**Step 2: Unit Testing with Terratest**
Create a Go test file (`network_test.go`) to validate subnet CIDR ranges and route table associations:
```go
package test

import (
	"testing"
	"github.com/gruntwork-io/terratest/modules/terraform"
)

func TestNetworkModule(t *testing.T) {
	t.Parallel()
	
	opts := &terraform.Options{
		TerraformDir: "../modules/aws-network",
		Vars: map[string]interface{}{
			"environment": "test",
		},
	}
	
	defer terraform.Destroy(t, opts)
	terraform.InitAndApply(t, opts)
	
	// Validate subnet CIDRs
	subnetCidrs := terraform.OutputList(t, opts, "subnet_cidrs")
	assert.Equal(t, []string{"10.0.1.0/24", "10.0.2.0/24"}, subnetCidrs)
}
```
Run tests with:
```bash
go test -v -timeout 30m
```

**Step 3: CI/CD Pipeline Integration**
Add this GitHub Actions workflow (`.github/workflows/terraform.yml`):
```yaml
name: Terraform CI/CD

on:
  pull_request:
    paths:
      - 'modules/aws-network/**'

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: opentofu/setup-opentofu@v1
        with:
          tofu_version: "1.7.0"
      - name: Validate
        run: |
          cd modules/aws-network
          tofu init -upgrade
          tofu validate
          tofu plan -out=tfplan -var-file=test.tfvars -strict
      - name: Test
        run: |
          cd modules/aws-network
          go test -v -timeout 30m
  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: opentofu/setup-opentofu@v1
      - name: Apply
        run: |
          cd modules/aws-network
          tofu apply -auto-approve -var-file=prod.tfvars
        env:
          TF_VAR_aws_region: "us-west-2"
```

**Step 4: Production Deployment Checklist**
1. **Pre-deployment**:
   - Verify `terraform.tfstate` backup exists
   - Check drift detection with `tofu plan -detailed-exitcode`
   - Review change summary from the plan output
2. **Post-deployment**:
   - Run smoke tests against the new resources
   - Update documentation in `README.md`
   - Tag the release in Git with semantic versioning

**Best Practices Applied**:
- Used OpenTofu instead of Terraform for future-proofing
- Implemented strict mode validation to catch potential issues early
- Separated test and production variables
- Added parallel testing for faster feedback
- Included state backup and drift detection in the workflow