What is Terratest and How Does It Test Infrastructure Code?
Learn what Terratest is, how it applies real Terraform infrastructure, asserts on live behavior, and guarantees teardown — interview answer.
Expected Interview Answer
Terratest is a Go library from Gruntwork that lets engineers write real integration tests for infrastructure code — it programmatically applies a Terraform (or Packer, Kubernetes, or Docker) configuration, makes live HTTP, SSH, or API assertions against the resulting resources, and then automatically destroys everything afterward.
A typical Terratest test calls `terraform.InitAndApply` against a target module directory, retrieves output values like a load balancer DNS name via `terraform.Output`, then uses helper functions like `http_helper.HttpGetWithRetry` or an AWS SDK client to validate the deployed infrastructure actually behaves as expected — for example, that a web server returns HTTP 200 within a retry window. A `defer terraform.Destroy` at the top of the test guarantees teardown even if an assertion fails midway, preventing orphaned cloud resources from accumulating cost. Because it drives real `terraform apply` against real cloud accounts (often a dedicated sandbox account), Terratest catches issues that plan-only unit tests or static analysis cannot, such as a security group rule that technically parses correctly but actually blocks the traffic it needs to allow. Tests typically run with parallelism and retries built in, since cloud APIs are eventually consistent and can be flaky.
- Validates real, deployed infrastructure behavior, not just plan output
- Guaranteed teardown via defer prevents orphaned test resources
- Works across Terraform, Packer, Kubernetes, and Docker, not just one tool
- Catches issues static analysis and unit tests structurally cannot see
AI Mentor Explanation
Terratest is like a groundsman not just checking the pitch report on paper, but actually rolling a real ball down it and timing the bounce with a stopwatch before declaring it match-ready, then rolling the covers back over the pitch when done regardless of what the test showed. The stopwatch check is the live assertion — does the ball actually bounce the way the report claimed. The covers going back on afterward, no matter the result, is the guaranteed cleanup so the ground is never left exposed. This live-ball test catches problems no written report alone would reveal.
Step-by-Step Explanation
Step 1
Write the Go test
Import the terratest/modules/terraform package and target the Terraform module directory to test.
Step 2
Defer destroy immediately
Call `defer terraform.Destroy(t, opts)` right after apply so teardown always runs, even on assertion failure.
Step 3
Apply and fetch outputs
`terraform.InitAndApply` provisions real resources; `terraform.Output` retrieves values like endpoints or IDs.
Step 4
Assert against live behavior
Use HTTP, SSH, or cloud SDK helpers with retries to validate the deployed infrastructure actually works as intended.
What Interviewer Expects
- Knowledge that Terratest is a Go library driving real terraform apply/destroy
- Understanding of `defer terraform.Destroy` as the guaranteed-cleanup pattern
- Awareness that it makes live assertions (HTTP/SSH/SDK), not plan-only checks
- Recognition that it should run against a sandboxed cloud account, not production
Common Mistakes
- Forgetting `defer terraform.Destroy`, leaking real cloud resources and cost
- Running Terratest suites directly against production accounts
- Not adding retries for eventually-consistent cloud APIs, causing flaky tests
- Treating Terratest as a replacement for static analysis instead of a complementary layer
Best Answer (HR Friendly)
“Terratest is a testing library that lets us actually deploy our infrastructure code to a real, temporary cloud environment, check that it behaves correctly — like a server actually responding to requests — and then automatically tear everything down afterward. It gives us much higher confidence than just reviewing a plan on paper, because it catches problems that only show up once resources are truly running.”
Code Example
func TestWebServerModule(t *testing.T) {
opts := &terraform.Options{
TerraformDir: "../examples/webserver",
}
defer terraform.Destroy(t, opts)
terraform.InitAndApply(t, opts)
url := terraform.Output(t, opts, "endpoint_url")
http_helper.HttpGetWithRetry(
t, url, nil, 200, "OK", 10, 5*time.Second,
)
}Follow-up Questions
- How do you keep Terratest suites from becoming too slow for CI?
- How do you isolate parallel Terratest runs so they do not collide on resource names?
- What happens if a Terratest run crashes before the deferred Destroy executes?
- How would you test a Kubernetes manifest with Terratest instead of Terraform?
MCQ Practice
1. What language is Terratest written in and used with?
Terratest is a Go library; tests are written as standard Go test functions.
2. What Terratest pattern guarantees test infrastructure is cleaned up even on failure?
Using Go's `defer` with `terraform.Destroy` immediately after apply ensures teardown runs regardless of whether later assertions fail.
3. What kind of assertions does Terratest typically make?
Terratest applies real infrastructure and then makes live assertions, such as HTTP requests or SSH commands, against the deployed resources.
Flash Cards
What is Terratest? — A Go library for writing real integration tests against deployed Terraform (and other) infrastructure.
Why use `defer terraform.Destroy`? — To guarantee test infrastructure is torn down even if an assertion fails, preventing cost leaks.
What kind of checks does Terratest run? — Live HTTP, SSH, or cloud SDK assertions against real, deployed resources.
Where should Terratest suites run? — Against a dedicated sandbox cloud account, never production.