Terratest and Sentinel provide complementary testing capabilities for infrastructure as code. Terratest allows end-to-end testing of infrastructure during development but is slower to run, while Sentinel performs faster compliance and security checks against infrastructure and is aware of the current Terraform plan or configuration. Together they help ensure infrastructure is deployed correctly and meets business and regulatory requirements with flexible testing at multiple stages of the development and deployment process.

1. Terratest +
Sentinel
A Match Made in Heaven

3. What is
FundApps?
We help investment managers harness the
power of community and technology to
automate regulatory compliance.
In layman’s terms, clients upload an XML file,
our engine performs operations over the file
and we serve the results back to them

4. Engine Next
Architecture
Fargate, Lambdas and Step
functions
No shared infrastructure
across clients
Core engine contained in a
single Terraform module,
one separate TFE workspace
per client tenant

6. What do
we test
at each
stage?
Strength in flexibility
The pipeline is flexible enough so that we didn’t need to think
about all the requirements in advance
Static checks
Fast to run, limited utility
Terratest
Slower to run, end to end tests, no context of the “here and
now” (always spinning up and tearing down infrastructure)
Main use cases: developer velocity, security and compliance
Example: Check that an ECS cluster can spin up correctly with
the right security group and IAM roles
Sentinel
Fast to run and aware of the “here and now” (able to interact
with Terraform primitives like plans and config)
Main use cases: last guardrail before deploying to production,
cancel an apply based on business-specific context
Example: Don’t destroy specific resource types without
recreating them, don’t apply changes if a client is running a
file (by calling a custom API)

7. Key takeaways
Beware of the blast radius
We’re a small team and Terratest
can apply in ~6-7 minutes
(mostly serverless resources). If
your plan takes much longer than
that or if you have a huge team
(think of the state lock) you may
have an impact on developer
velocity.
Version modules carefully
We use a mix of local, public and
private modules. Versioning the
modules has multiple advantages
but remember that each change
may require multiple PRs – don’t
try to version everything just
because you feel you need to.
Design for flexibility
You may not know in advance all
the business requirements but
it’s guaranteed they will change
over time. If you can’t do
everything, think about the most
fragile pieces of your infra and
test those first. Ideally, your
Sentinel policies should test the
most unique pieces of your
business logic and sit as close as
possible to your production
environments, whereas running
Terratest closer to your
developers allows them to
quickly reiterate in case of
failure.

8. THANK YOU | Compliance made simple fundapps.co