Testing infrastructure

Unit and integration tests for infra.

Because a Pulumi program is code, you can test it with the language’s normal test tools — a genuine advantage of the model. Two levels: unit tests mock the cloud and assert on resource inputs (“the bucket is never public,” “every instance has a tag”) in milliseconds with no deployment; integration tests actually deploy a stack to a sandbox, assert against the real resources, then tear it down.

import * as pulumi from "@pulumi/pulumi";
pulumi.runtime.setMocks({           // no real cloud calls
  newResource: (a) => ({ id: `${a.name}-id`, state: a.inputs }),
  call: () => ({}),
});
describe("infra", () => {
  it("never makes a public bucket", async () => {
    const infra = await import("./index");
    const acl = await promiseOf((infra.logs as any).acl);
    expect(acl).not.toBe("public-read");
  });
});

Integration and property tests

For higher confidence, the integration test framework deploys the stack to a throwaway environment, runs assertions (the endpoint responds, the bucket rejects public access) against live infrastructure, and destroys it. And CrossGuard doubles as property testing — running the policy pack in a test asserts invariants hold for whatever the program generates, not just the cases you hand-wrote.

$ npm test                 # fast unit tests, mocked, no deploy
PASS  ./index.test.ts  (0.9s)
$ go test ./integration    # deploys to a sandbox, asserts, destroys