Terraform Test hanging during execution #35380
Comments
|
@liamcervante I think you helped me with some Terraform test stuff in the past - do you have any ideas why this might be happening? |
|
Update: I tried to test in a different project that was also having the same issue. The tests point to examples that are in an
# run "unit_test" {
# command = plan
# module {
# source = "./examples/create-users-and-groups"
# }
# }
# run "e2e_test" {
# command = apply
# module {
# source = "./examples/create-users-and-groups"
# }
# }
# run "unit_test" {
# command = plan
# module {
# source = "./examples/existing-users-and-groups"
# }
# }
# run "e2e_test" {
# command = apply
# module {
# source = "./examples/existing-users-and-groups"
# }
# }
# run "unit_test" {
# command = plan
# module {
# source = "./examples/inline-policy"
# }
# }
# run "e2e_test" {
# command = apply
# module {
# source = "./examples/inline-policy"
# }
# }
run "unit_test" {
command = plan
module {
source = "./examples/google-workspace"
}
}
run "e2e_test" {
command = apply
module {
source = "./examples/google-workspace"
}
}I tried the following steps to resolve:
The following steps resolves the issue where it was hanging, however now it looks look ❯ tft
tests/01_create_users_and_groups.tftest.hcl... in progress
tests/01_create_users_and_groups.tftest.hcl... tearing down
tests/01_create_users_and_groups.tftest.hcl... pass
tests/02_existing_users_and_groups.tftest.hcl... in progress
tests/02_existing_users_and_groups.tftest.hcl... tearing down
tests/02_existing_users_and_groups.tftest.hcl... pass
tests/03_inline_policy.tftest.hcl... in progress
tests/03_inline_policy.tftest.hcl... tearing down
tests/03_inline_policy.tftest.hcl... pass
tests/04_google_workspace.tftest.hcl... in progress
run "unit_test"... pass
run "e2e_test"... pass
tests/04_google_workspace.tftest.hcl... tearing down
tests/04_google_workspace.tftest.hcl... pass
Success! 2 passed, 0 failed.Is this expected? I assumed that tests with commented out/blank file contents would just be skipped. As nothing should be created in that case, the |
|
Update: after removing the comments from the above tests, it's hanging again (has been 20+min since running ❯ tft
tests/01_create_users_and_groups.tftest.hcl... in progress
run "unit_test"... pass
run "e2e_test"... pass
tests/01_create_users_and_groups.tftest.hcl... tearing down
tests/01_create_users_and_groups.tftest.hcl... pass
tests/02_existing_users_and_groups.tftest.hcl... in progress
run "unit_test"... pass
run "e2e_test"... pass
tests/02_existing_users_and_groups.tftest.hcl... tearing down
tests/02_existing_users_and_groups.tftest.hcl... pass
tests/03_inline_policy.tftest.hcl... in progress
tests/03_inline_policy.tftest.hcl... tearing down
tests/03_inline_policy.tftest.hcl... pass
tests/04_google_workspace.tftest.hcl... in progress
run "unit_test"... pass
run "e2e_test"... pass
tests/04_google_workspace.tftest.hcl... tearing down
tests/04_google_workspace.tftest.hcl... pass
Success! 6 passed, 0 failed.
❯ tft
tests/01_create_users_and_groups.tftest.hcl... in progress
run "unit_test"... pass
run "e2e_test"... pass
tests/01_create_users_and_groups.tftest.hcl... tearing down
tests/01_create_users_and_groups.tftest.hcl... pass
tests/02_existing_users_and_groups.tftest.hcl... in progress
run "unit_test"... pass
run "e2e_test"... pass
tests/02_existing_users_and_groups.tftest.hcl... tearing down
tests/02_existing_users_and_groups.tftest.hcl... pass
tests/03_inline_policy.tftest.hcl... in progress
run "unit_test"... passIt's stuck on the |
|
Hi @novekm, are you able to share the Terraform configuration files that are being tested? I'd have a better idea at what might be happening then. When cancelling a test Terraform does attempt to clean up any resources that it created, but if you request a hard-cancel (that is pressing ctrl-c twice) then it'll quite without waiting for confirmation that everything was able to be deleted. In that case it should print a list of resources that it couldn't confirm were actually deleted. Terraform Test isn't particularly clever in the way it executes - you can replicate the behaviour of the test command simply by executing |
|
Hi Liam, here are all the configuration files that are gun tested: https://github.com/aws-ia/terraform-aws-iam-identity-center/tree/main/examples and there's the inline policy configuration: data "aws_organizations_organization" "org" {}
# Create Inline Policy
# IMPORTANT - This policy has an explicit deny. This is used as an example only.
# Ensure you understand the impact of this policy before deploying.
data "aws_iam_policy_document" "restrictAccessInlinePolicy" {
statement {
sid = "Restrict"
actions = [
"*",
]
effect = "Deny"
resources = [
"*",
]
condition {
test = "NotIpAddress"
variable = "aws:SourceIp"
values = [
// replace with your own IP address
"0.0.0.0/0",
]
}
condition {
test = "Bool"
variable = "aws:ViaAWSService"
values = [
"false"
]
}
condition {
test = "StringNotLike"
variable = "aws:userAgent"
values = [
"*exec-env/CloudShell*"
]
}
}
}
# locals {
# active_accounts = [for a in data.aws_organizations_organization.org.accounts : a if a.status == "ACTIVE"]
# tags = {
# "Owner" = "SRE Team"
# }
# }
module "aws-iam-identity-center" {
source = "../.." // local example
# source = "aws-ia/iam-identity-center/aws" // remote example
existing_sso_groups = {
AWSControlTowerAdmins : {
group_name = "AWSControlTowerAdmins"
}
}
sso_groups = {
Admin : {
group_name = "Admin"
group_description = "Admin Group"
},
Dev : {
group_name = "Dev"
group_description = "Dev Group"
},
}
sso_users = {
nuzumaki : {
group_membership = ["Admin", "Dev", "AWSControlTowerAdmins"]
user_name = "nuzumaki"
given_name = "Naruto"
family_name = "Uzumaki"
email = "[email protected]"
},
suchiha : {
group_membership = ["Dev", "AWSControlTowerAdmins"]
user_name = "suchiha"
given_name = "Sasuke"
family_name = "Uchiha"
email = "[email protected]"
},
}
existing_permission_sets = {
AWSAdministratorAccess : {
permission_set_name = "AWSAdministratorAccess"
},
}
permission_sets = {
AdministratorAccess = {
description = "Provides full access to AWS services and resources",
session_duration = "PT3H",
aws_managed_policies = ["arn:aws:iam::aws:policy/AdministratorAccess"]
inline_policy = data.aws_iam_policy_document.restrictAccessInlinePolicy.json
tags = { ManagedBy = "Terraform" }
},
PowerUserAccess = {
description = "Provides full access to AWS services and resources, but does not allow management of Users and groups",
session_duration = "PT3H",
aws_managed_policies = ["arn:aws:iam::aws:policy/PowerUserAccess"]
tags = { ManagedBy = "Terraform" }
},
ViewOnlyAccess = {
description = "This policy grants permissions to view resources and basic metadata across all AWS services",
session_duration = "PT3H",
aws_managed_policies = ["arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"]
managed_policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
permissions_boundary = {
managed_policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
}
tags = { ManagedBy = "Terraform" }
},
ReadOnlyAccess = {
description = "This policy grants permissions to view resources and basic metadata across all AWS services",
session_duration = "PT3H",
aws_managed_policies = ["arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"]
managed_policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
tags = { ManagedBy = "Terraform" }
},
}
account_assignments = {
Admin : {
principal_name = "Admin"
principal_type = "GROUP"
principal_idp = "INTERNAL"
permission_sets = [
"AdministratorAccess",
"PowerUserAccess",
"ViewOnlyAccess",
// existing permission set
"AWSAdministratorAccess",
]
account_ids = [
// replace with your own account id
local.account1_account_id,
# local.account2_account_id
# local.account3_account_id
# local.account4_account_id
]
},
Dev : {
principal_name = "Dev"
principal_type = "GROUP"
principal_idp = "INTERNAL"
permission_sets = [
"PowerUserAccess",
"ViewOnlyAccess",
]
account_ids = [
// replace with your own account id
local.account1_account_id,
# local.account2_account_id
# local.account3_account_id
# local.account4_account_id
]
},
}
}I'll rerun Terraform apply and post the outcome |
|
Hi @liamcervante, taking another look at this now. I ran Related to this, is there a cli command to manually output a like of the resources that must be manually destroyed if you have to cancel a terraform test? Also, is there a way to run the test with elapsed time, as is standard when running |
Thanks for following up! Unfortunately, the destroy failure story isn't the best at the moment so the only way to really discover the left over resources is to look at the output of the test command that was cancelled. This is something that is in active discovery as we're looking at a better way to handle this. You can follow this issue for updates on this. In addition, you can get in touch with our Product Manager directly if you have any ideas about how you'd want this to work.
There isn't a way to do this currently, but I think this should be a fairly straight forward request. Could you file this as a separate feature request in this repository? That way we can include it in our planning and prioritisation. I think I can close this issue given you've resolved the problematic behaviour and the desired behaviour is captured in another ticket. Let me know if there's anything that I've missed! |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Terraform Version
Terraform Configuration Files
Debug Output
Expected Behavior
Successful execution of the tests
Actual Behavior
terraform testis hanging during executionI'm not sure if this is potential due to cancelling during the test. How does Terraform test handle state management and when a user has to cancel a test? I'm assuming it would work the same as cancelling an apply, which would leave the resources in the AWS account.
Steps to Reproduce
terraform testAdditional Context
For additional context, this test and the test that I cancelled (due to it stalling) are being run in the same AWS account. How does Terraform test handle state management and when a user has to cancel a test?
Also here is the directory structure:
References
No response
The text was updated successfully, but these errors were encountered: