Skip to content

Conversation

@goruha
Copy link
Contributor

@goruha goruha commented Oct 23, 2025

what

  • Added tests
  • Resolve cycled dependency between cloud trail and cloud trail bucket logs

Why

Summary by CodeRabbit

Release Notes

  • New Features

    • S3 object lock configuration is now conditionally applied based on configuration settings—disabled when lock days are set to zero.
  • Tests

    • Added comprehensive test suite for component validation with multiple test scenarios.
    • Established test fixtures and configuration infrastructure for integration testing.
  • Chores

    • Updated test infrastructure and build configuration.
    • Enhanced git ignore rules for test artifacts and temporary files.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Oct 23, 2025

Walkthrough

The PR renames the CloudTrail label module to cloudtrail_bucket_label, updates all related ARN and context references in IAM policies, adds conditional object lock configuration based on days variables, introduces a default null value for query_override, and establishes comprehensive test infrastructure with Go tests and Atmos fixture configurations.

Changes

Cohort / File(s) Summary
Terraform Configuration
src/main.tf, src/variables.tf
Module renamed from cloudtrail_label to cloudtrail_bucket_label with updated IAM policy ARN references. Object lock configuration made conditional (null when days variable equals 0). Added default = null to query_override variable.
Test Suite Implementation
test/component_test.go
New Go test file introducing ComponentSuite struct with TestBasic, TestEnabledFlag, SetupSuite, TearDownSuite methods. Tests deploy component, manage Datadog API credentials via SSM, verify enabled flag behavior, and handle cleanup via helper.Run.
Test Fixtures - Configuration
test/fixtures/atmos.yaml, test/fixtures/vendor.yaml, test/fixtures/stacks/catalog/*.yaml, test/fixtures/stacks/orgs/default/test/*.yaml
Added Atmos base configuration, vendor manifest for component sources, catalog components (account-map, datadog-configuration, datadog-integration), use-case fixtures (basic/disabled), stack defaults with account mapping, and tests.yaml importing all fixtures.
Test Module and Metadata
test/.gitignore, test/go.mod, test/run.sh
Updated .gitignore with state/, .cache, .atmos, test-suite.json, test_suite.yaml entries. Added Go module definition (go 1.23.4) with dependencies. Emptied run.sh script.
Documentation
test/README.md
Deleted placeholder README file.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

The change involves moderate heterogeneity across Terraform configuration updates (module rename with dependent reference changes), new Go test logic with multi-method test suite implementation, and extensive configuration fixture files. While individual pieces follow clear patterns, the scope spans multiple file types and requires verification of consistency across module references and correctness of test orchestration logic.

Possibly related PRs

Suggested labels

needs-test, minor

Poem

🐰 A refactor hops through the code with grace,
cloudtrail_bucket_label takes its place,
With fixtures stacked and tests that gleam,
The CloudTrail streams now follow the scheme!
Lock and key dance when days align,
Test fixtures glow—infrastructure divine! ✨

Pre-merge checks and finishing touches

❌ Failed checks (2 warnings)
Check name Status Explanation Resolution
Title Check ⚠️ Warning The title "Added tests" is only partially related to the changeset. While the PR does add test files (test/component_test.go, test fixtures, and test configuration), this represents a minor portion of the overall changes. The primary modifications in this PR are substantial refactoring in src/main.tf—including renaming the cloudtrail_label module to cloudtrail_bucket_label, updating IAM policy documents, and adding conditional object lock configuration—plus changes to the public API in src/variables.tf (adding a default value to query_override). According to the PR description, the PR also aims to resolve a cyclic dependency issue (#70). The title completely omits these significant infrastructure and API changes, making it misleading to someone scanning the commit history. Update the title to highlight the primary infrastructure changes and refactoring, such as "Refactor cloudtrail label module and add tests" or "Resolve cyclic dependency with conditional object lock configuration and tests." This would accurately convey that the PR contains significant production code changes beyond just test additions, helping reviewers and future developers understand the scope of the changes at a glance.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch add-tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@mergify mergify bot requested review from a team October 23, 2025 20:02
@mergify
Copy link

mergify bot commented Oct 23, 2025

Important

Do not edit the README.md directly. It's auto-generated from the README.yaml

Please update the README.yaml file instead.

Could you fix it @goruha? 🙏

@mergify mergify bot added the triage Needs triage label Oct 23, 2025
@goruha
Copy link
Contributor Author

goruha commented Oct 23, 2025

/terratest

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
test/go.mod (1)

17-17: Remove commented-out replace directive if not needed.

The commented replace directive for aws-nuke appears to be unused. If it's not needed, remove it to keep the module file clean. If it's needed for documentation, consider adding a comment explaining why it's kept.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d8a88e8 and 215bee1.

⛔ Files ignored due to path filters (1)
  • test/go.sum is excluded by !**/*.sum
📒 Files selected for processing (16)
  • src/main.tf (10 hunks)
  • src/variables.tf (1 hunks)
  • test/.gitignore (1 hunks)
  • test/README.md (0 hunks)
  • test/component_test.go (1 hunks)
  • test/fixtures/atmos.yaml (1 hunks)
  • test/fixtures/stacks/catalog/account-map.yaml (1 hunks)
  • test/fixtures/stacks/catalog/datadog-configuration.yaml (1 hunks)
  • test/fixtures/stacks/catalog/datadog-integration.yaml (1 hunks)
  • test/fixtures/stacks/catalog/usecase/basic.yaml (1 hunks)
  • test/fixtures/stacks/catalog/usecase/disabled.yaml (1 hunks)
  • test/fixtures/stacks/orgs/default/test/_defaults.yaml (1 hunks)
  • test/fixtures/stacks/orgs/default/test/tests.yaml (1 hunks)
  • test/fixtures/vendor.yaml (1 hunks)
  • test/go.mod (1 hunks)
  • test/run.sh (0 hunks)
💤 Files with no reviewable changes (2)
  • test/run.sh
  • test/README.md
🧰 Additional context used
📓 Path-based instructions (6)
**/*.{yaml,yml,md}

📄 CodeRabbit inference engine (AGENTS.md)

Use 2-space indentation for YAML and Markdown files

Files:

  • test/fixtures/stacks/catalog/datadog-configuration.yaml
  • test/fixtures/stacks/catalog/datadog-integration.yaml
  • test/fixtures/stacks/orgs/default/test/tests.yaml
  • test/fixtures/vendor.yaml
  • test/fixtures/atmos.yaml
  • test/fixtures/stacks/orgs/default/test/_defaults.yaml
  • test/fixtures/stacks/catalog/usecase/disabled.yaml
  • test/fixtures/stacks/catalog/usecase/basic.yaml
  • test/fixtures/stacks/catalog/account-map.yaml
src/{main,variables,outputs,providers,versions,context}.tf

📄 CodeRabbit inference engine (AGENTS.md)

Keep the Terraform component’s source of truth in src/ with canonical files: main.tf, variables.tf, outputs.tf, providers.tf, versions.tf, and context.tf

Files:

  • src/variables.tf
  • src/main.tf
**/*.tf

📄 CodeRabbit inference engine (AGENTS.md)

**/*.tf: Use 2-space indentation for all Terraform files
In Terraform, use lower_snake_case for variables and locals; keep resource/data source names descriptive and aligned with Cloud Posse null-label patterns
Run terraform fmt and adhere to TFLint rules defined in .tflint.hcl; do not commit formatting or lint violations

Files:

  • src/variables.tf
  • src/main.tf
test/**/*_test.go

📄 CodeRabbit inference engine (AGENTS.md)

test/**/*_test.go: Place tests under test/ and name them *_test.go
Use Go Terratest with github.com/cloudposse/test-helpers and Atmos fixtures for integration tests

Files:

  • test/component_test.go
test/component_test.go

📄 CodeRabbit inference engine (AGENTS.md)

Provide the Terratest entrypoint in test/component_test.go

Files:

  • test/component_test.go
test/fixtures/stacks/catalog/usecase/**

📄 CodeRabbit inference engine (AGENTS.md)

Add test scenarios under test/fixtures/stacks/catalog/usecase/

Files:

  • test/fixtures/stacks/catalog/usecase/disabled.yaml
  • test/fixtures/stacks/catalog/usecase/basic.yaml
🪛 Checkov (3.2.334)
src/main.tf

[medium] 223-229: Ensure Terraform module sources use a commit hash

(CKV_TF_1)

🪛 OSV Scanner (2.2.3)
test/go.mod

[HIGH] 1-1: golang.org/x/crypto 0.33.0: Potential denial of service in golang.org/x/crypto

(GO-2025-3487)


[HIGH] 1-1: golang.org/x/crypto 0.33.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange

(GHSA-hcg3-q754-cr77)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Summary
🔇 Additional comments (16)
test/.gitignore (1)

1-5: LGTM!

Standard test artifact exclusions aligned with the new test infrastructure. No concerns.

test/fixtures/vendor.yaml (1)

1-35: LGTM!

Well-structured Atmos vendor manifest with explicit version pinning. Component sources and target directories are properly configured.

src/variables.tf (1)

6-11: LGTM!

Adding default = null is appropriate here given the nullable = true constraint and the documented fallback behavior to the default query. Explicit defaults improve clarity for module consumers.

test/fixtures/atmos.yaml (1)

1-77: LGTM!

Comprehensive Atmos configuration with clear documentation of ENV/CLI overrides. The 2-space indentation and glob-based path patterns align with guidelines and test infrastructure needs.

src/main.tf (3)

223-229: Module rename complete and well-applied.

The rename from cloudtrail_label to cloudtrail_bucket_label is applied systematically across all references (ARN construction, context passing). This improves semantic clarity about the label's purpose.

Note: Static analysis flags using a version tag (0.25.0) instead of a commit hash. Version tags (following semantic versioning) are acceptable for Cloud Posse modules and provide better flexibility than commit pinning, but consider your team's pinning strategy for consistency.


214-218: Conditional object lock configuration allows disabling via zero-day values.

Setting object_lock_configuration = null when days == 0 is a clean pattern for optional S3 Object Lock, avoiding drift from empty/default values. This enables test scenarios (e.g., test/fixtures/stacks/catalog/usecase/basic.yaml) to disable Object Lock by setting both object_lock_days_archive and object_lock_days_cloudtrail to 0.

Also applies to: 281-285


99-103: SourceArn condition improved for specificity.

Updated SourceArn from trail/*datadog-logs-archive wildcard to trail/${module.this.id} provides better security posture by restricting the policy to the specific CloudTrail trail, reducing blast radius if credentials are compromised.

Also applies to: 133-138

test/fixtures/stacks/catalog/datadog-integration.yaml (1)

1-7: LGTM!

Standard Atmos component fixture with appropriate metadata and variable configuration.

test/fixtures/stacks/catalog/usecase/disabled.yaml (1)

1-8: LGTM!

Complementary fixture for testing the disabled state of the component. Naming convention (datadog-logs-archive/disabled) clearly indicates the scenario.

test/fixtures/stacks/catalog/usecase/basic.yaml (1)

1-10: LGTM!

Primary test fixture for enabled component. Setting object_lock_days_archive and object_lock_days_cloudtrail to 0 is intentional—this verifies the conditional null logic in src/main.tf for disabling S3 Object Lock, providing good coverage for the feature toggle.

test/fixtures/stacks/catalog/datadog-configuration.yaml (1)

1-11: LGTM!

The Datadog configuration fixture is well-structured with proper 2-space indentation and appropriate test values.

test/fixtures/stacks/orgs/default/test/tests.yaml (1)

1-6: LGTM!

Import structure is clean and follows the 2-space indentation guideline.

test/fixtures/stacks/catalog/account-map.yaml (1)

1-46: LGTM!

The account-map fixture is well-structured with helpful comments explaining the static backend configuration. The 2-space indentation is correct.

test/fixtures/stacks/orgs/default/test/_defaults.yaml (1)

1-66: LGTM!

The test defaults fixture is comprehensive and well-structured, with proper 2-space indentation and appropriate use of environment variable templates with sensible defaults.

test/component_test.go (2)

88-132: LGTM!

The suite setup is well-structured, properly validates required environment variables, and correctly manages test dependencies and SSM parameters.


134-149: LGTM!

Teardown and test entrypoint follow the cloudposse/test-helpers pattern correctly.

@goruha
Copy link
Contributor Author

goruha commented Oct 23, 2025

/terratest

@mergify mergify bot removed the triage Needs triage label Oct 23, 2025
@mergify mergify bot requested a review from a team October 23, 2025 20:32
@goruha goruha added this pull request to the merge queue Oct 23, 2025
Merged via the queue into main with commit 581237e Oct 23, 2025
19 checks passed
@goruha goruha deleted the add-tests branch October 23, 2025 20:48
@github-actions
Copy link
Contributor

These changes were released in v1.537.1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants