override_resource {
  target = module.deployment.aws_s3_bucket.this
  values = { id = "test-control", arn = "arn:aws:s3:::test-control" }
}
override_resource {
  target = module.primary_data.aws_s3_bucket.this
  values = { id = "test-primary", arn = "arn:aws:s3:::test-primary" }
}
override_resource {
  target = module.secondary_data.aws_s3_bucket.this
  values = { id = "test-secondary", arn = "arn:aws:s3:::test-secondary" }
}
mock_provider "aws" {
  mock_data "aws_ec2_instance_type_offerings" { defaults = { locations = ["eu-west-1a", "eu-west-1b"] } }
  alias = "primary"
  mock_data "aws_region" { defaults = { region = "eu-west-1" } }
  mock_data "aws_availability_zones" { defaults = { names = ["eu-west-1a", "eu-west-1b"] } }
  mock_data "aws_ami" { defaults = { id = "ami-0123456789abcdef0" } }
  mock_resource "aws_s3_bucket" { defaults = { arn = "arn:aws:s3:::mock-test-bucket", id = "mock-test-bucket" } }
  mock_resource "aws_iam_role" { defaults = { arn = "arn:aws:iam::123456789012:role/test" } }
}
mock_provider "aws" {
  mock_data "aws_ec2_instance_type_offerings" { defaults = { locations = ["eu-west-2a", "eu-west-2b"] } }
  alias = "secondary"
  mock_data "aws_region" { defaults = { region = "eu-west-2" } }
  mock_data "aws_availability_zones" { defaults = { names = ["eu-west-2a", "eu-west-2b"] } }
  mock_data "aws_ami" { defaults = { id = "ami-0123456789abcdef0" } }
  mock_resource "aws_s3_bucket" { defaults = { arn = "arn:aws:s3:::mock-test-bucket", id = "mock-test-bucket" } }
  mock_resource "aws_iam_role" { defaults = { arn = "arn:aws:iam::123456789012:role/test" } }
}
variables {
  aws_account_id     = "123456789012"
  name               = "test-carlos"
  apps_domain        = "apps.example.com"
  release_public_key = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
}
run "topology" {
  assert {
    condition     = toset(module.secondary.storage.object_resources) == toset(["arn:aws:s3:::test-control/*", "arn:aws:s3:::test-secondary/*"])
    error_message = "The secondary region must not access the primary region's data."
  }
  assert {
    condition     = module.secondary.storage.data_bucket == "test-secondary" && module.secondary.storage.data_region == "eu-west-2" && module.secondary.storage.deployment_region == "eu-west-1" && module.secondary.storage.deployment_bucket == "test-control"
    error_message = "Secondary-region storage and control-plane routing are crossed."
  }
  command = plan
  assert {
    condition     = module.primary.host_count == 1 && module.secondary.host_count == 1
    error_message = "Unexpected host count."
  }
}
run "reject_invalid_public_key" {
  command = plan
  variables { release_public_key = "not-a-public-key" }
  expect_failures = [var.release_public_key]
}
run "reject_shell_in_domain" {
  command = plan
  variables { apps_domain = "apps.example.com\nENVEOF\necho bad" }
  expect_failures = [var.apps_domain]
}
run "reject_same_region" {
  command = plan
  variables { secondary_region = "eu-west-1" }
  expect_failures = [terraform_data.topology]
}