[AWSCORE-694] mock AWS provider in all tests for CI readiness#33
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 11 commits intoMar 13, 2026
Merged
Conversation
ksirrah13
changed the title
Convert the remaining 6 test files from using `provider "aws"` to `mock_provider "aws"` so tests can run without AWS credentials. - Convert command = apply to command = plan (mock providers simulate resource creation without needing real AWS APIs) - Provide dd_api_key_secret_arn explicitly to avoid computed attribute references that are unknown at plan time - Replace !contains(keys()) null checks with == null assertions (plan-time behavior keeps null keys in the map) - Add dedicated secrets_manager_default_test for secret creation All 32 tests pass across 11 test files. AWSCORE-694
ksirrah13
force-pushed
the
kyle.harris/AWSCORE-694-mock-providers
branch
from
March 9, 2026 18:07
995eb73 to
6886f87
Compare
The mock provider treats secretsmanager secret ARNs as sensitive values, causing all tests to fail with "Output refers to sensitive values" error.
ksirrah13
marked this pull request as ready for review
March 9, 2026 18:13
…ig to true defaults Remove dd_api_key_secret_arn from default_config variables so it tests the actual default path (auto-create secret from dd_api_key). Move all secret management permutations to a dedicated secrets_management test file covering auto-create, external ARN, SSM parameter, and explicit create_dd_api_key_secret=false paths.
ksirrah13
force-pushed
the
kyle.harris/AWSCORE-694-mock-providers
branch
from
March 9, 2026 18:34
f1b2b8b to
b2de6ea
Compare
Add two CI workflows that run on pull requests: - terraform-fmt: checks formatting with terraform fmt -recursive - terraform-test: runs terraform test using mock providers (no AWS credentials needed)
3 tasks
[AWSCORE-694] Add CI workflows for terraform fmt and test
ktmq
reviewed
Mar 11, 2026
| command = plan | ||
|
|
||
| variables { | ||
| dd_api_key = "test-api-key-value" |
Contributor
There was a problem hiding this comment.
is this needed? or is part of the test showing that this value is ignored when dd_api_key_secret_arn is provided?
Contributor
Author
There was a problem hiding this comment.
This is a great point. It was copied from existing tests but those also seem to be wrong to be setting both the api_key and secret_arn values (even though we ignore the API key). I cleaned them all up so that if we set the arn we don't set the API key. I also added a warning that if customers are setting both right now it will only use one and they should clean it up. Thanks!
ktmq
previously approved these changes
Mar 11, 2026
dd_api_key defaults to null and should not be set alongside dd_api_key_secret_arn per the variable docs. Removing it makes the test accurately represent the "bring your own secret" path.
- Remove dd_api_key where it conflicts with dd_api_key_secret_arn or dd_api_key_ssm_parameter_name (variable docs say choose ONE approach) - Remove explicit null assignments for variables that already default to null (dd_api_key, dd_api_key_secret_arn) - Remove out-of-scope S3 bucket assertion from optional_env_vars test (already covered by enhanced_features test) Affected files: secrets_management, enhanced_features, optional_env_vars, existing_resources, existing_iam_role_without_bucket
Add validation rules that reject conflicting API key configurations instead of silently ignoring one. The three approaches (dd_api_key, dd_api_key_secret_arn, dd_api_key_ssm_parameter_name) are now mutually exclusive at the variable level. Add tests for all three pairwise conflict scenarios.
… conflicts Replace variable validation blocks with check blocks that produce warnings instead of errors. This avoids breaking existing customers who may have multiple API key variables set. The warnings explain which value is being ignored and that this will become a hard error in a future release.
ktmq
approved these changes
Mar 11, 2026
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: queued
mergequeue-status: in_progress
and removed
mergequeue-status: queued
labels
gh-worker-dd-mergequeue-cf854d
Bot
deleted the
kyle.harris/AWSCORE-694-mock-providers
branch
March 13, 2026 14:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
provider "aws"tomock_provider "aws"so tests run without AWS credentialscommand = applytocommand = plansince mock providers don't need real resource creationdd_api_key_secret_arnoutput as sensitive (required by mock provider treating secretsmanager ARNs as sensitive)secrets_management.tftest.hclcovering all API key configuration paths:dd_api_key(default path)dd_api_key_secret_arnprovideddd_api_key_ssm_parameter_namecreate_dd_api_key_secret = falsewith external ARNdefault_config.tftest.hclto test true defaults (nodd_api_key_secret_arnoverride)Context
AWSCORE-694 — This PR covers the mock provider migration and CI setup. CI setup completed in this stacked PR.
#34
Test plan
terraform testpasses locally — 44 passed, 0 failed