Skip to content

Manual Test Runbook — F6: State-Backend Module

Owner: Sagar  |  Time: ~20 min  |  Sandbox: snowops-sandbox-01

Prerequisites

  • Sandbox subscription access active (PIM activated if required)
  • az login done; az account show confirms the sandbox subscription is selected
  • Identity has Storage Blob Data Contributor on the sandbox subscription
  • Local tooling: terraform >= 1.6, go >= 1.22, az CLI >= 2.50
  • SNOWOPS_SANDBOX_SUBSCRIPTION_ID and SNOWOPS_SANDBOX_TENANT_ID env vars set
  • Working directory: repo root

Steps

Part A — terraform validate (no cloud, ~1 min)

  1. Run the validate-only test to confirm the HCL compiles cleanly:
cd tests/terratest
go test -v -timeout 5m ./modules/azure/... -run TestStateBackendValidate
  1. Confirm output ends with PASS.

Part B — full integration test (real Azure, ~15 min)

  1. Ensure env vars are exported:
export SNOWOPS_SANDBOX_SUBSCRIPTION_ID="<sandbox-subscription-guid>"
export SNOWOPS_SANDBOX_TENANT_ID="<sandbox-tenant-guid>"
  1. Run the integration test:
cd tests/terratest
go test -v -tags integration -timeout 20m ./modules/azure/... -run TestStateBackendModule
  1. Watch the output for these key steps:
  2. InitAndApply on state-backend fixture → storage account created
  3. InitAndApply on state-backend-consumer fixture → uses SA as backend
  4. Both Destroy calls succeed in reverse order (consumer first, then backend)

Part C — manual spot-check (optional, ~2 min)

  1. While the test is running (after step A's apply completes, before destroy), you can verify the storage account in the portal or via CLI:
az storage account list --resource-group "snowops-f6-test-*-rg" \
  --query "[].{name:name, replication:sku.name, tls:minimumTlsVersion}" \
  --output table

Expected: sku.name = Standard_RAGZRS, minimumTlsVersion = TLS1_2.

  1. Verify the state blob exists in the container during the consumer apply:
az storage blob list \
  --account-name "<sa-name-from-test-output>" \
  --container-name tfstate \
  --auth-mode login \
  --output table

Expected: one blob named f6-probe-<suffix>.tfstate.

Pass criteria

  • TestStateBackendValidate passes (no cloud needed)
  • TestStateBackendModule passes end-to-end (real Azure apply + destroy)
  • Storage account created with Standard_RAGZRS replication
  • primary_blob_endpoint output contains blob.core.windows.net
  • Consumer fixture successfully used the SA as Terraform backend
  • lock_probe_output equals f6-lock-probe-ok
  • Both destroy calls complete without error (ephemeral=true tag present)
  • No orphaned resource groups remain after the test

Teardown

The test fixture tags all resources ephemeral=true. If the test fails mid-run and resources are orphaned, clean up manually:

az group delete --name "snowops-f6-test-*-rg" --yes --no-wait

Or the X7 nightly cleanup workflow will remove them within 24h.

Sign-off

  • Tester: _  |  Date: _  |  Result: PASS / FAIL / N/A
  • Notes: