Add Terraform tests

.github/workflows/tflint.yml

@@ -1,11 +1,21 @@
 name: TFLint
 on: [push]
+
 jobs:
-  terraform_fmt:
+  terraform_test:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
       - uses: hashicorp/setup-terraform@v2
-      - run: terraform fmt -check -recursive
+        with:
+          terraform_version: "1.6.2"
+      - name: init
+        run: terraform init
+      - name: test
+        working-directory: aws
+        run: terraform test
+      - name: fmt
+        run: terraform fmt -check -recursive
 
   lint_aws:
     runs-on: ubuntu-latest

aws/tests/variables.tftest.hcl

@@ -0,0 +1,46 @@
+variables {
+  vpc_id             = "vpc-123"
+  ssh_keypair        = "test_keypair"
+  subnet_ids         = ["subnet-1"]
+  availability_zones = ["az-1"]
+}
+
+run "no password" {
+  command = plan
+
+  variables {
+    cratedb_password = null
+  }
+}
+
+run "provided password" {
+  command = plan
+
+  variables {
+    cratedb_password = "zie6aeya9ooMeey0yai5"
+  }
+}
+
+run "password with double dollar signs" {
+  command = plan
+
+  variables {
+    cratedb_password = "ab$$cd"
+  }
+
+  expect_failures = [
+    var.cratedb_password,
+  ]
+}
+
+run "password with double quote" {
+  command = plan
+
+  variables {
+    cratedb_password = "ab\"cd"
+  }
+
+  expect_failures = [
+    var.cratedb_password,
+  ]
+}

aws/variables.tf

@@ -40,7 +40,7 @@ variable "cratedb_password" {
   sensitive   = true
   description = "The password to use for the CrateDB database user. If null, a random password will be assigned."
   validation {
-    condition     = var.cratedb_password == null || (!strcontains(var.cratedb_password, "$$") && !strcontains(var.cratedb_password, "\""))
+    condition     = var.cratedb_password == null || (!try(strcontains(var.cratedb_password, "$$"), false) && !try(strcontains(var.cratedb_password, "\""), false))
     error_message = "The CrateDB password must not contain any of the following character sequences: $$, \""
   }
 }