IaC & Container Configuration Testing

Misconfiguration is a leading cause of cloud incidents. Shift it left: test infrastructure definitions like code, before they are applied.

Pipeline: lint → scan → policy → plan-test → runtime

terraform fmt -check && terraform validate && tflint
checkov -d . --framework terraform,kubernetes,dockerfile,helm
trivy config --severity HIGH,CRITICAL .
terraform plan -out tf.plan && terraform show -json tf.plan > plan.json
conftest test plan.json -p policy/                     # OPA/Rego on the plan
helm template chart | kubeconform -strict -            # schema validation
kube-linter lint k8s/ ; kubescape scan framework nsa k8s/
hadolint Dockerfile
trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 myapp:1.2.3

Checklist by layer

Policy-as-code example (Rego)

package terraform.s3
deny[msg] {
  r := input.resource_changes[_]
  r.type == "aws_s3_bucket_public_access_block"
  r.change.after.block_public_acls == false
  msg := sprintf("%s must block public ACLs", [r.address])
}

Enforce the same rules at admission with Kyverno or Gatekeeper (require-non-root, disallow-latest-tag, require-resource-limits). Test the policies too: opa test policy/ -v, kyverno test ..

Test infrastructure behaviour, not just config

Terratest, terraform test or Pulumi tests: create ephemeral infra, assert outputs and reachability, destroy. Add drift detection (terraform plan -detailed-exitcode nightly) and idempotency (second apply = no changes).

Triage

Suppress only with an inline reason, owner and expiry (#checkov:skip=CKV_AWS_18:reason). Prioritise internet-exposed, data-bearing, privileged resources.

Related

cloud-infrastructure-testing, supply-chain-dependency-testing, security-hardening, compliance-testing, configuration-feature-flag-testing