Add tests

.gitignore

@@ -7,6 +7,7 @@ aws-assumed-role/
 *.iml
 .direnv
 .envrc
+.cache
 
 # Compiled and auto-generated files
 # Note that the leading "**/" appears necessary for Docker even if not for Git

src/remote-state.tf

@@ -1,6 +1,6 @@
 module "private_ca" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.5.0"
+  version = "1.8.0"
 
   count = local.private_ca_enabled ? 1 : 0
 
@@ -13,7 +13,7 @@ module "private_ca" {
 
 module "dns_delegated" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.5.0"
+  version = "1.8.0"
 
   component   = var.dns_delegated_component_name
   stage       = var.dns_delegated_stage_name

test/.gitignore

@@ -0,0 +1,5 @@
+state/
+.cache
+test/test-suite.json
+.atmos
+test_suite.yaml

test/component_test.go

@@ -0,0 +1,138 @@
+package test
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/acm"
+	"github.com/aws/aws-sdk-go-v2/service/acm/types"
+	"github.com/cloudposse/test-helpers/pkg/atmos"
+	helper "github.com/cloudposse/test-helpers/pkg/atmos/component-helper"
+	"github.com/gruntwork-io/terratest/modules/aws"
+	"github.com/gruntwork-io/terratest/modules/random"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type validationOption struct {
+	DomainName          string `json:"domain_name"`
+	ResourceRecordName  string `json:"resource_record_name"`
+	ResourceRecordType  string `json:"resource_record_type"`
+	ResourceRecordValue string `json:"resource_record_value"`
+}
+
+type zone struct {
+	Arn               string            `json:"arn"`
+	Comment           string            `json:"comment"`
+	DelegationSetId   string            `json:"delegation_set_id"`
+	ForceDestroy      bool              `json:"force_destroy"`
+	Id                string            `json:"id"`
+	Name              string            `json:"name"`
+	NameServers       []string          `json:"name_servers"`
+	PrimaryNameServer string            `json:"primary_name_server"`
+	Tags              map[string]string `json:"tags"`
+	TagsAll           map[string]string `json:"tags_all"`
+	Vpc               []struct {
+		ID     string `json:"vpc_id"`
+		Region string `json:"vpc_region"`
+	} `json:"vpc"`
+	ZoneID string `json:"zone_id"`
+}
+
+type ComponentSuite struct {
+	helper.TestSuite
+}
+
+func (s *ComponentSuite) TestBasic() {
+	const component = "acm/basic"
+	const stack = "default-test"
+	const awsRegion = "us-east-2"
+
+	// Reference the delegated DNS component
+	dnsDelegatedOptions := s.GetAtmosOptions("dns-delegated", "default-test", nil)
+
+	// Retrieve outputs from the delegated DNS component
+	delegatedDomainName := atmos.Output(s.T(), dnsDelegatedOptions, "default_domain_name")
+	domainZoneId := atmos.Output(s.T(), dnsDelegatedOptions, "default_dns_zone_id")
+
+	domainName := fmt.Sprintf("%s.%s", s.Config.RandomIdentifier, delegatedDomainName)
+
+	// Inputs for the ACM component
+	inputs := map[string]interface{}{
+		"enabled":                           true,
+		"process_domain_validation_options": true,
+		"validation_method":                 "DNS",
+		"domain_name":                       domainName,
+	}
+
+	defer s.DestroyAtmosComponent(s.T(), component, stack, &inputs)
+	options, _ := s.DeployAtmosComponent(s.T(), component, stack, &inputs)
+
+	// Validate the ACM outputs
+	id := atmos.Output(s.T(), options, "id")
+	assert.NotEmpty(s.T(), id)
+
+	arn := atmos.Output(s.T(), options, "arn")
+	assert.NotEmpty(s.T(), arn)
+
+	domainNameOuput := atmos.Output(s.T(), options, "domain_name")
+	assert.Equal(s.T(), domainName, domainNameOuput)
+
+	// Verify that the ACM certificate ARN is stored in SSM
+	ssmPath := fmt.Sprintf("/acm/%s", domainName)
+	acmArnSssmStored := aws.GetParameter(s.T(), awsRegion, ssmPath)
+	assert.Equal(s.T(), arn, acmArnSssmStored)
+
+	// Validate domain validation options
+	validationOptions := [][]validationOption{}
+	atmos.OutputStruct(s.T(), options, "domain_validation_options", &validationOptions)
+	for _, validationOption := range validationOptions[0] {
+		if validationOption.DomainName != domainName {
+			continue
+		}
+		assert.Equal(s.T(), domainName, validationOption.DomainName)
+
+		// Verify DNS validation records
+		resourceRecordName := strings.TrimSuffix(validationOption.ResourceRecordName, ".")
+		validationDNSRecord := aws.GetRoute53Record(s.T(), domainZoneId, resourceRecordName, validationOption.ResourceRecordType, awsRegion)
+		assert.Equal(s.T(), validationOption.ResourceRecordValue, *validationDNSRecord.ResourceRecords[0].Value)
+	}
+
+	// Validate the ACM certificate in AWS
+	client := aws.NewAcmClient(s.T(), awsRegion)
+	awsCertificate, err := client.DescribeCertificate(context.Background(), &acm.DescribeCertificateInput{
+		CertificateArn: &arn,
+	})
+	require.NoError(s.T(), err)
+
+	// Ensure the certificate type and ARN match expectations
+	assert.Equal(s.T(), string(types.CertificateStatusIssued), string(awsCertificate.Certificate.Status))
+	assert.Equal(s.T(), string(types.CertificateTypeAmazonIssued), string(awsCertificate.Certificate.Type))
+	assert.Equal(s.T(), arn, *awsCertificate.Certificate.CertificateArn)
+
+	s.DriftTest(component, stack, &inputs)
+}
+
+func (s *ComponentSuite) TestEnabledFlag() {
+	const component = "acm/disabled"
+	const stack = "default-test"
+	s.VerifyEnabledFlag(component, stack, nil)
+}
+
+func TestRunSuite(t *testing.T) {
+	suite := new(ComponentSuite)
+
+	subdomain := strings.ToLower(random.UniqueId())
+	inputs := map[string]interface{}{
+		"zone_config": []map[string]interface{}{
+			{
+				"subdomain": subdomain,
+				"zone_name": "components.cptest.test-automation.app",
+			},
+		},
+	}
+	suite.AddDependency(t, "dns-delegated", "default-test", &inputs)
+	helper.Run(t, suite)
+}

test/fixtures/atmos.yaml

@@ -0,0 +1,87 @@
+# CLI config is loaded from the following locations (from lowest to highest priority):
+# system dir (`/usr/local/etc/atmos` on Linux, `%LOCALAPPDATA%/atmos` on Windows)
+# home dir (~/.atmos)
+# current directory
+# ENV vars
+# Command-line arguments
+#
+# It supports POSIX-style Globs for file names/paths (double-star `**` is supported)
+# https://en.wikipedia.org/wiki/Glob_(programming)
+
+# Base path for components, stacks and workflows configurations.
+# Can also be set using `ATMOS_BASE_PATH` ENV var, or `--base-path` command-line argument.
+# Supports both absolute and relative paths.
+# If not provided or is an empty string, `components.terraform.base_path`, `components.helmfile.base_path`, `stacks.base_path` and `workflows.base_path`
+# are independent settings (supporting both absolute and relative paths).
+# If `base_path` is provided, `components.terraform.base_path`, `components.helmfile.base_path`, `stacks.base_path` and `workflows.base_path`
+# are considered paths relative to `base_path`.
+base_path: ""
+
+components:
+  terraform:
+    # Can also be set using `ATMOS_COMPONENTS_TERRAFORM_BASE_PATH` ENV var, or `--terraform-dir` command-line argument
+    # Supports both absolute and relative paths
+    base_path: "components/terraform"
+    # Can also be set using `ATMOS_COMPONENTS_TERRAFORM_APPLY_AUTO_APPROVE` ENV var
+    apply_auto_approve: true
+    # Can also be set using `ATMOS_COMPONENTS_TERRAFORM_DEPLOY_RUN_INIT` ENV var, or `--deploy-run-init` command-line argument
+    deploy_run_init: true
+    # Can also be set using `ATMOS_COMPONENTS_TERRAFORM_INIT_RUN_RECONFIGURE` ENV var, or `--init-run-reconfigure` command-line argument
+    init_run_reconfigure: true
+    # Can also be set using `ATMOS_COMPONENTS_TERRAFORM_AUTO_GENERATE_BACKEND_FILE` ENV var, or `--auto-generate-backend-file` command-line argument
+    auto_generate_backend_file: true
+
+stacks:
+  # Can also be set using `ATMOS_STACKS_BASE_PATH` ENV var, or `--config-dir` and `--stacks-dir` command-line arguments
+  # Supports both absolute and relative paths
+  base_path: "stacks"
+  # Can also be set using `ATMOS_STACKS_INCLUDED_PATHS` ENV var (comma-separated values string)
+  # Since we are distinguishing stacks based on namespace, and namespace is not part
+  # of the stack name, we have to set `included_paths` via the ENV var in the Dockerfile
+  included_paths:
+    - "orgs/**/*"
+
+  # Can also be set using `ATMOS_STACKS_EXCLUDED_PATHS` ENV var (comma-separated values string)
+  excluded_paths:
+    - "**/_defaults.yaml"
+
+  # Can also be set using `ATMOS_STACKS_NAME_PATTERN` ENV var
+  name_pattern: "{tenant}-{stage}"
+
+workflows:
+  # Can also be set using `ATMOS_WORKFLOWS_BASE_PATH` ENV var, or `--workflows-dir` command-line arguments
+  # Supports both absolute and relative paths
+  base_path: "stacks/workflows"
+
+# https://github.com/cloudposse/atmos/releases/tag/v1.33.0
+logs:
+  file: "/dev/stdout"
+  # Supported log levels: Trace, Debug, Info, Warning, Off
+  level: Info
+
+settings:
+  # Can also be set using 'ATMOS_SETTINGS_LIST_MERGE_STRATEGY' environment variable, or '--settings-list-merge-strategy' command-line argument
+  list_merge_strategy: replace
+
+# `Go` templates in Atmos manifests
+# https://atmos.tools/core-concepts/stacks/templating
+# https://pkg.go.dev/text/template
+templates:
+  settings:
+    enabled: true
+    # https://masterminds.github.io/sprig
+    sprig:
+      enabled: true
+    # https://docs.gomplate.ca
+    gomplate:
+      enabled: true
+
+commands:
+  - name: "test-components"
+    description: "List the Atmos virtual components configured for testing"
+    steps:
+      - >
+        atmos describe stacks --format json --sections=component,metadata --components=component -s sandbox
+        | jq '.[] | .components.terraform | to_entries | 
+        map(select(.value.component == "component" and (.value.metadata.type != "abstract" or .value.metadata.type == null))) 
+        | .[].key' 

test/fixtures/stacks/catalog/account-map.yaml

@@ -0,0 +1,46 @@
+components:
+  terraform:
+    account-map:
+      metadata:
+        terraform_workspace: core-gbl-root
+      vars:
+        tenant: core
+        environment: gbl
+        stage: root
+
+#      This remote state is only for Cloud Posse internal use.
+#      It references the Cloud Posse test organizations actual infrastructure.
+#      remote_state_backend:
+#        s3:
+#          bucket: cptest-core-ue2-root-tfstate-core
+#          dynamodb_table: cptest-core-ue2-root-tfstate-core-lock
+#          role_arn: arn:aws:iam::822777368227:role/cptest-core-gbl-root-tfstate-core-ro
+#          encrypt: true
+#          key: terraform.tfstate
+#          acl: bucket-owner-full-control
+#          region: us-east-2
+
+      remote_state_backend_type: static
+      remote_state_backend:
+        # This static backend is used for tests that only need to use the account map iam-roles module
+        # to find the role to assume for Terraform operations. It is configured to use whatever
+        # the current user's role is, but the environment variable `TEST_ACCOUNT_ID` must be set to
+        # the account ID of the account that the user is currently assuming a role in.
+        #
+        # For some components, this backend is missing important data, and those components
+        # will need that data added to the backend configuration in order to work properly.
+        static:
+          account_info_map: {}
+          all_accounts: []
+          aws_partition: aws
+          full_account_map: {}
+          iam_role_arn_templates: {}
+          non_eks_accounts: []
+          profiles_enabled: false
+          root_account_aws_name: root
+          terraform_access_map: {}
+          terraform_dynamic_role_enabled: false
+          terraform_role_name_map:
+            apply: terraform
+            plan: planner
+          terraform_roles: {}

test/fixtures/stacks/catalog/dns-delegated.yaml

@@ -0,0 +1,10 @@
+components:
+  terraform:
+    dns-delegated:
+      metadata:
+        component: dns-delegated
+      vars:
+        zone_config:
+          - subdomain: test
+            zone_name: example.net
+        request_acm_certificate: false  

test/fixtures/stacks/catalog/dns-primary.yaml

@@ -0,0 +1,9 @@
+components:
+  terraform:
+    dns-primary:
+      metadata:
+        component: dns-primary
+      vars: 
+        domain_names:
+          - example.net
+        record_config: []

test/fixtures/stacks/catalog/usecase/basic.yaml

@@ -0,0 +1,15 @@
+components:
+  terraform:
+    acm/basic:
+      metadata:
+        component: target
+      vars: 
+        enabled: true
+        domain_name: example.net
+        process_domain_validation_options: true
+        validation_method: DNS
+        dns_delegated_environment_name: ue2
+        # NOTE: The following subject alternative name is automatically added by the module.
+        #       Additional entries can be added by providing this input.
+        # subject_alternative_names:
+        #   - "*.example.net"

test/fixtures/stacks/catalog/usecase/disabled.yaml

@@ -0,0 +1,15 @@
+components:
+  terraform:
+    acm/disabled:
+      metadata:
+        component: target
+      vars: 
+        enabled: false
+        domain_name: example.net
+        process_domain_validation_options: true
+        validation_method: DNS
+        dns_delegated_environment_name: ue2
+        # NOTE: The following subject alternative name is automatically added by the module.
+        #       Additional entries can be added by providing this input.
+        # subject_alternative_names:
+        #   - "*.example.net"